2c75b0bb93fd2dac2b1b4f17394bf200_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2c75b0bb93fd2dac2b1b4f17394bf200_JaffaCakes118
Size

13KB
MD5

2c75b0bb93fd2dac2b1b4f17394bf200
SHA1

2bff4841154f5b7d56d7069ae881b80cca4d7d54
SHA256

f104ffa43dac08c19ba8ac61f5884a78808aab2279f01eabb2f81b027e133dc1
SHA512

e5c33f74e705a2a83482464a7dd9a6d8fcce82f22339c5b19207c7fe66ce7aab6889834da1f71946fbddbe51a11335dcc5b8e6d5b40c9162d1c3287405724acb
SSDEEP

192:k3p6L2rFMbM6KTSsWkUGuqXyHcskyD9vJ/8cm0q:qp6uF+GWbZBLvD9x8cm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c75b0bb93fd2dac2b1b4f17394bf200_JaffaCakes118

Files

2c75b0bb93fd2dac2b1b4f17394bf200_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3a716057f28a9f59a90bdb063d0de580

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

dm5/getunlock.php

Imports

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
VirtualQuery
GetModuleHandleA
SetErrorMode
CreateThread
HeapAlloc
Sleep
LoadLibraryA
ExitProcess
GetProcAddress
FreeLibrary
GetVersionExA
GetModuleFileNameA
GetProcessHeap
GetCurrentProcess
IsDebuggerPresent

user32

GetDC
GetMessageA
TranslateMessage
DefWindowProcA
RegisterClassA
DispatchMessageA
LoadCursorA

gdi32

GetDeviceCaps

advapi32

CloseServiceHandle
QueryServiceStatus
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
AllocateAndInitializeSid
OpenServiceA
OpenSCManagerA

ole32

CoCreateInstance
CoInitializeEx
CoInitialize

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ