bb40168a6c252bf62ed7b928db2ddca3_JaffaCakes118 | Triage

Sharing

General

Target

bb40168a6c252bf62ed7b928db2ddca3_JaffaCakes118
Size

235KB
MD5

bb40168a6c252bf62ed7b928db2ddca3
SHA1

fc0f23691751b63d93d6efbbbdb5ec7e01a07c14
SHA256

bd024645f51a267c6d24a75649cb617ac29029d5e9f8a3d8aa8c44b44cf668c9
SHA512

5db4268d3d9a539ccaa43f47b73a8b9a3730a5be57d0256c99c855e1a0ce58a525955fa6562d9ff389adc0951a691fd9f280c0b9297a827223361c6dbe92a52c
SSDEEP

6144:A89I85FiKeBfbarbNyicAdmXyzLAGkgqBPp02:A864FiKedbAbzIyX3g7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
bb40168a6c252bf62ed7b928db2ddca3_JaffaCakes118

Files

bb40168a6c252bf62ed7b928db2ddca3_JaffaCakes118
.exe windows:6 windows x86 arch:x86

dc195339b27b4fd5a57110edcd4091c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
FindClose
FindFirstFileW
FindNextFileW
GetFullPathNameW
SetFileAttributesW
WriteFile
GetLastError
HeapAlloc
GetProcessHeap
VirtualProtect
GetModuleHandleW
lstrcmpW
lstrcpyW
lstrcatW
WideCharToMultiByte
WriteConsoleW
GetConsoleWindow

user32

GetDC
GrayStringW
LoadStringW
ShowWindow

msvcrt

_controlfp
_except_handler3
__set_app_type
wcspbrk
_exit
_XcptFilter
exit
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ