3b2d9a79ecfe7ebe65e1a98800f76d3c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b2d9a79ecfe7ebe65e1a98800f76d3c_JaffaCakes118
Size

621KB
MD5

3b2d9a79ecfe7ebe65e1a98800f76d3c
SHA1

1f18831a29b0998e3a598d1de1076d081228ca4b
SHA256

ff3f8f453036511fd7da622ad3792bbe03e60f9b69e2b03956c8ddb1ca6f4156
SHA512

d4cac2a717b54d91f15ea6176601409c521cf66d57e160fc81feca6d4a246809e2217a95ecfa4e93c30550044c3986c136851aecc8302496a0f05bab23018458
SSDEEP

12288:w5hAPjVQDNwwkBr/2BvEb0DS6jtmw1Bp3FkKwE31iV74uDqXYDvL:wgq2wkp2AQBmuFKE1c4MnDv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b2d9a79ecfe7ebe65e1a98800f76d3c_JaffaCakes118

Files

3b2d9a79ecfe7ebe65e1a98800f76d3c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6d1f028787ecd18f946abf29ae022207

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect

user32

EndPaint

advapi32

RegCloseKey

shell32

ShellExecuteA

iphlpapi

GetAdaptersInfo

ws2_32

htonl

wtsapi32

WTSRegisterSessionNotification

Sections

.text
Size: 65KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 471KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Khsgd
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE