0e5dca6660f538a362a1908b763e1830_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e5dca6660f538a362a1908b763e1830_JaffaCakes118
Size

13.6MB
MD5

0e5dca6660f538a362a1908b763e1830
SHA1

8b95b0ec9ce9976368849cf0ad3b1b7a738472de
SHA256

f45bce97a98fed46271805fea006c5654752952c2d898a72e053288569080ea8
SHA512

1abb990c570a3ab29ef675e9f105cf3d90a90669b231bb9673499662769ab3679e396eeb3d50c75e0b3fc71873ddcedef412c7524fab55c99c95ef9a6eb7ef5d
SSDEEP

1536:sijD738OroNKoBBDGqprbJD9RU/VHmubHMFaGkrESk8T9jKGtdvdmG:sij33broxDLVk/Nm7rSXBKGT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e5dca6660f538a362a1908b763e1830_JaffaCakes118

Files

0e5dca6660f538a362a1908b763e1830_JaffaCakes118
.exe windows:5 windows x86 arch:x86

628c281723cdfaf5317593ea2fc6dfa2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

authz

AuthzFreeAuditEvent
AuthzInitializeContextFromSid
AuthzFreeResourceManager

rsaenh

CPDeriveKey
CPDecrypt
CPEncrypt
CPGenKey
CPCreateHash

kernel32

FindResourceW
GetWindowsDirectoryW
CopyFileW
GetExitCodeProcess
OpenMutexA
FindNextFileW
VirtualAlloc
GetLastError
MoveFileA
GetModuleHandleA
CreateWaitableTimerA
LoadLibraryW
InterlockedIncrement
GetSystemTime
DeleteFileA
WaitForSingleObject
GetOEMCP
OpenSemaphoreA
UnmapViewOfFile

user32

IsCharLowerW
PeekMessageA
DialogBoxParamW
LoadIconA
LoadBitmapW
DrawStateA
GetPropW
CharToOemW
DispatchMessageW
wsprintfA
MessageBoxA
CreateDesktopW
FindWindowA
GetDlgItemTextA
GetFocus
GetMessageW

Sections

.text1
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE

mail
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ddata
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13.5MB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ