cef3598b719653fe4abfd00a0ee40d5c_JaffaCakes118 | Triage

Sharing

General

Target

cef3598b719653fe4abfd00a0ee40d5c_JaffaCakes118
Size

106KB
MD5

cef3598b719653fe4abfd00a0ee40d5c
SHA1

63afc1c7f69583d59730fa487ae9c129bcadcdf6
SHA256

5a7b26907e84d4137fd153e3b0f6a7b6565a6d68ce081c4b627ec5d70b0285c6
SHA512

a146fedac2164f76168a5daedee3288a061f68d31d5231a0caec8f0d9ee3b71e6776bd1c84d4425953d2f8f3a2b8ccfdc37b57b1b5cb4abf18d254dcf7fe3ceb
SSDEEP

3072:0fXiJhc/uYvsjY7lrf1dM/eL1hsKUqQ3ERHPouWc:cF/dvsU7O/0hsSRhWc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cef3598b719653fe4abfd00a0ee40d5c_JaffaCakes118

Files

cef3598b719653fe4abfd00a0ee40d5c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1b63a1bcb61e496bddee82f3d8300e0d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strchr
strncpy
NtYieldExecution
_stricmp
memset
memcpy

kernel32

GetLastError
GetProcessHeap
InterlockedIncrement
HeapAlloc
ExitProcess

user32

MessageBoxIndirectW

comctl32

InitCommonControlsEx
ImageList_Add

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ