5de16e644095099e744f588690e7e400_JaffaCakes118 | Triage

Sharing

General

Target

5de16e644095099e744f588690e7e400_JaffaCakes118
Size

229KB
MD5

5de16e644095099e744f588690e7e400
SHA1

0e3dc321554ae6081ee7f4437353457d7360d121
SHA256

26fb8675c58beebfed1a2c246fa5fd658ed0286305dc64683fe4d34b41cc5a66
SHA512

a7087b2f0a294ab4268ec2d498fa23d075de0adf714de81d57d7910135387e12aa90adc50eba183246cc9d834778405818af5630dda6adf968ad25582c2c47b6
SSDEEP

6144:10khhhhhhhhhhhhhN8gBVP+MO4L952L6sCpKN2LKgP1Gkohh8h8mHxpBmPZO:GkhhhhhhhhhhhhhOgvP+MzL95X7P1Ghi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5de16e644095099e744f588690e7e400_JaffaCakes118

Files

5de16e644095099e744f588690e7e400_JaffaCakes118
.exe windows:6 windows x86 arch:x86

dc195339b27b4fd5a57110edcd4091c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetFullPathNameW
SetFileAttributesW
WriteFile
GetLastError
HeapAlloc
GetProcessHeap
VirtualProtect
GetModuleHandleW
lstrcmpW
lstrcpyW
lstrcatW
WideCharToMultiByte
WriteConsoleW
GetConsoleWindow

user32

GetDC
GrayStringW
LoadStringW
ShowWindow

msvcrt

_controlfp
_except_handler3
__set_app_type
wcspbrk
_exit
_XcptFilter
exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ