4385e9f12588e2d94882aaca8ab32337_JaffaCakes118 | Triage

Sharing

General

Target

4385e9f12588e2d94882aaca8ab32337_JaffaCakes118
Size

41KB
MD5

4385e9f12588e2d94882aaca8ab32337
SHA1

f310832aa795d51a2f0e5f5b883d9fc9edaa29b8
SHA256

d2739675c0a7143c8e10d1c4a8a7ddac5dc73625d3591760ce3785e872eb619a
SHA512

986903b3515b0d69b0cb1ea8910599035ddbe082d6e97d3dab4ee5d69d5630638745ffbf1b930628d4d77acb3d0b143aae53bc9c2741e544bc41e2ee0fae0937
SSDEEP

768:pdRXBFAlC83KHssB6l85B0zRXMKzCEDOWWSRZKimS0wjedurT:PRbAlpInoMK2EaSfKimSHT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
4385e9f12588e2d94882aaca8ab32337_JaffaCakes118

Files

4385e9f12588e2d94882aaca8ab32337_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2ea3d3c8416c41050897b478725a89f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalSize
VirtualProtect
LoadLibraryA
GlobalLock
GetCommandLineW
GlobalUnlock
GlobalFix

user32

PeekMessageA
BeginPaint

Exports

Exports

Cvfjwtpe
InitAqrdpbg

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.DATA21
Size: 3KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 27KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.e4355
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ