JaffaCakes118_ba806a404ff67fac0ed57ba80981ad2f | Triage

Sharing

General

Target

JaffaCakes118_ba806a404ff67fac0ed57ba80981ad2f
Size

816KB
MD5

ba806a404ff67fac0ed57ba80981ad2f
SHA1

65ece10850f703484f7dff14413367c5ed5cf043
SHA256

4f1264f48d067f02f6611f0bba567c87b0783c134529c4a16d1b7c2f3b4d9a65
SHA512

1ce7c6ef991c9eabdf1353c2d26068b57c19e5ece5a5976bad5af0663558563fdfd9dfa19e0d80c5234128f114457a9c554dae60f2b6962d00b8cb8b0da6bfa0
SSDEEP

12288:chRTBpMWNtKWcbn7uVddMnqhvGfqT1OYYd24meOIdfKfPVsmrAVAH6ADx4m2Jsb/:aSiMb7Y/NhvVBXeOIoXVAVBoN6s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_ba806a404ff67fac0ed57ba80981ad2f

Files

JaffaCakes118_ba806a404ff67fac0ed57ba80981ad2f
.exe windows:5 windows x86 arch:x86

68513621e853e7c9491f8c57c29b474a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__fmode
__set_app_type
_except_handler3
__p__commode
_controlfp
__dllonexit
_onexit
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
memset
memmove
??3@YAXPAX@Z
??2@YAPAXI@Z

user32

LoadMenuA
CreateDialogParamA

kernel32

WriteProcessMemory
GetStartupInfoA
GetCommandLineA
CreateProcessA
FindResourceA
GetModuleHandleA
GetProcAddress
GetLastError
WaitForSingleObject
CreateThread
CloseHandle
VirtualAllocEx

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 802KB - Virtual size: 802KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ