80ee353884779a0484a8c2f1a4d09e10_JaffaCakes118 | Triage

Sharing

General

Target

80ee353884779a0484a8c2f1a4d09e10_JaffaCakes118
Size

648KB
MD5

80ee353884779a0484a8c2f1a4d09e10
SHA1

9f06127986e611efcf022a398a1db02497cd1f86
SHA256

3eee35e2da8d727156e4ac74426f9ee320051fe209ddeb50c9f47119d07365d0
SHA512

154aa8b85ba8cbd9801e68a044532ef88201d59b4c681d8ec223558663b53b3cf718b14f0621f0b758e1cadd6f040215c2ca68270b21a6b319e177aafa49bfe4
SSDEEP

12288:/L37lQ33skuuXuwdFPTXReg6hdfH4eiV1cQGJ53Q:eLI1hdgeiV17GXQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
80ee353884779a0484a8c2f1a4d09e10_JaffaCakes118

Files

80ee353884779a0484a8c2f1a4d09e10_JaffaCakes118
.exe windows:6 windows x86 arch:x86

dc195339b27b4fd5a57110edcd4091c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetFullPathNameW
SetFileAttributesW
WriteFile
GetLastError
HeapAlloc
GetProcessHeap
VirtualProtect
GetModuleHandleW
lstrcmpW
lstrcpyW
lstrcatW
WideCharToMultiByte
WriteConsoleW
GetConsoleWindow

user32

GetDC
GrayStringW
LoadStringW
ShowWindow

msvcrt

_controlfp
_except_handler3
__set_app_type
wcspbrk
_exit
_XcptFilter
exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 420KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ