28ed0a8aca77083983edf103919dbabc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28ed0a8aca77083983edf103919dbabc_JaffaCakes118
Size

33KB
MD5

28ed0a8aca77083983edf103919dbabc
SHA1

94a1165a66b263217a4a11c282940d7569d3c609
SHA256

05b18bb1dc5fdfaf7143ebd1f8aee63ec2e3f96d7b406d9711e2755bc75fd9c7
SHA512

40b3884eb3cd249b2ee5d1d31e631d955f1a9fa0c27d2aea191c713f529fed1a67cad8dbc5cbc4aa6fe8edf4cea4b123bfbda139b7ac83c87bf8d5da4312a330
SSDEEP

768:9OIVs3ErkEph+M7RNuNSKr7QWVU34Vrc:oGKE/neNZRu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28ed0a8aca77083983edf103919dbabc_JaffaCakes118

Files

28ed0a8aca77083983edf103919dbabc_JaffaCakes118
.exe windows:5 windows x86 arch:x86

17e4ad109d08aecdda41f6f43be47fed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateFileA
MoveFileExA
FreeLibrary
WriteFile
GetSystemDirectoryA
lstrcatA
lstrcmpiA
GetProcAddress
LoadLibraryA
MoveFileA
GetModuleFileNameA
WinExec
CloseHandle
DeleteFileA
lstrcpyA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

user32

CopyIcon
LoadCursorA
SetSystemCursor

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 358B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ