3b7a01fa2ce49f64495ccbf77e44181d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b7a01fa2ce49f64495ccbf77e44181d_JaffaCakes118
Size

234KB
MD5

3b7a01fa2ce49f64495ccbf77e44181d
SHA1

6d04d2a8836bd786ab5b6a4f65d824bd39b996e5
SHA256

ca2ace56b68279dd66ab587ab686144aeeea31705cfee7a67c172213ed97fead
SHA512

da5d8c2f4c6e06d096b6eb38752bfc05cf65f5d3a194dc48775ad7a670aa46c5bb49cb512167e50228b7da0b6bc1159eb66e3267eccc49b5dcf01b7112889152
SSDEEP

6144:wah+UfJTP4yjo9WAM3g/NDhLGbGdiMZ7tVednH:waY8llgWAMw/NhGbYfzVyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b7a01fa2ce49f64495ccbf77e44181d_JaffaCakes118

Files

3b7a01fa2ce49f64495ccbf77e44181d_JaffaCakes118
.exe .ps1 windows:5 windows x86 arch:x86 polyglot

3c6e5793e514214727b5614fbe758755

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
CreateFileW
GetFileSize
ReadFile
CloseHandle
VirtualAlloc
GetModuleHandleA
GetProcAddress
VirtualFree
GetProcessHeap
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapFree

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 229KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE