3e6f38936207e971bb7e6731d647e685_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e6f38936207e971bb7e6731d647e685_JaffaCakes118
Size

458KB
MD5

3e6f38936207e971bb7e6731d647e685
SHA1

316424716140e62956fa43954f58299ba0b30f6e
SHA256

63011862a4ec377b12040024ebc82686c5ca4d96745603af05032bc73bd5fde9
SHA512

b958bcd44a54dd2ae5e39bf09be30a0a1cfb7b89725480cd0170792ecf3773524ef7ea4bb8b6700ac1cace8f09ca13d9e43cfb492cc0f2e1d3e56b511d240502
SSDEEP

12288:SvRLNn3ObPgKHhR1zxSjDQoyazsfX6Sc7NQky1nJz5:knGPgC71FS3wv6SCQp1Jl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e6f38936207e971bb7e6731d647e685_JaffaCakes118

Files

3e6f38936207e971bb7e6731d647e685_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4710e694cbc904bbde58b1960e1a3f6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
HeapFree
GetTickCount
GetModuleFileNameW
SetEnvironmentVariableW
GetCurrentProcessId
OpenFileMappingW
GetLastError
MapViewOfFile
CloseHandle
CreateFileW
CreateFileMappingW
UnmapViewOfFile
GetFileInformationByHandle
VirtualAlloc
VirtualFree
GetModuleHandleA
GetFileSizeEx
GetProcAddress
LoadLibraryW

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xcpad
Size: - Virtual size: 210KB

.idata
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 424B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ