43611effbc05165bb7222072d4679d66_JaffaCakes118 | Triage

Sharing

General

Target

43611effbc05165bb7222072d4679d66_JaffaCakes118
Size

13KB
MD5

43611effbc05165bb7222072d4679d66
SHA1

bd1ed899025827633bd9560398ec762c17101158
SHA256

f9fdfd0824c05e1522e7180844e33c777fd60e0b47ae2c8b309387dff6740f43
SHA512

ca0a9da661c44e6a9dd93df9863076fe02fd22b2273b0bcf1202634991e11647e348d528e32cc37070885b2c98819a51b23d86386e63c77e8e459574fb6829dd
SSDEEP

192:A21Ce5EDa07QACl0OlzRRZqRbP++XCbqUK0q:t44dACaOltRQfz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43611effbc05165bb7222072d4679d66_JaffaCakes118

Files

43611effbc05165bb7222072d4679d66_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f07303654f77db48713e1b0f390a06f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
lstrlenA
WriteFile
GetProcAddress
CloseHandle
HeapFree
GetTickCount
GetProcessHeap
Sleep
lstrcatA
GlobalFree
GetTempFileNameA
LoadLibraryA
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RtlUnwind
IsDebuggerPresent

user32

wsprintfA

netapi32

Netbios

ws2_32

WSAStartup
WSACleanup

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ