308237758601f9c007a33846fe065c40_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

308237758601f9c007a33846fe065c40_JaffaCakes118
Size

351KB
MD5

308237758601f9c007a33846fe065c40
SHA1

4a43e8bc2bea9a6287d92dffb8073d82d41e01f5
SHA256

18b474d7b036d69ba7bf80fcfbfb259ed67810dca26654b103d88e3e1828fb27
SHA512

ef0d163f9a0cc6a72721aa07de1d41a836d1e37b426cc7925356ccd64fcbae58c6f20e66062e79f749ca96400fbc4fc4db33624e4fcb508041c5d3c4a904b8c1
SSDEEP

6144:NS4dexr/g8wAtXCKY8T3C5nff0fkj1UBhQSaI:w4g1/F39RKf0fB7naI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
308237758601f9c007a33846fe065c40_JaffaCakes118

Files

308237758601f9c007a33846fe065c40_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1bb3dd6dfb4b2aefa0a06068e3a91db2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
VirtualAlloc
GetStartupInfoW
GetCommandLineW
CreateFileW

user32

LoadIconA
LoadCursorA

advapi32

RegOpenKeyW

msvcrt

memcpy

Sections

.text
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data2
Size: 512B - Virtual size: 199B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

7
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

6
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

5
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

4
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ