e7a5027b109171d9fb824158f0ca3ba6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e7a5027b109171d9fb824158f0ca3ba6_JaffaCakes118
Size

50KB
MD5

e7a5027b109171d9fb824158f0ca3ba6
SHA1

1a29541f2187df33faec6c873ab617c9382fbd8f
SHA256

543be99c066275226a3fe3f26cd7e8a809b6fb3912f6a0dc9fe2e652e24ca82e
SHA512

2a9eee9c6427091f51fd924c5f048835a312e1b757f3ae8ae34fbbec4a6c514ea8bcb3d9d7693418dcbc0d39eff0a84af18e9d29d66640bf14d5887e5d6fc0da
SSDEEP

1536:rVrHvOioChgoXwflhf3xbybtK3hb9GFwqpNKzsUozTe:rVrPFoChgoXcN2tK3hBq1/UoW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7a5027b109171d9fb824158f0ca3ba6_JaffaCakes118

Files

e7a5027b109171d9fb824158f0ca3ba6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

f34444ea69dd2a5ed8ad6619addf724c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsW

shlwapi

PathCombineW
PathFileExistsW
PathRemoveFileSpecW
SHDeleteKeyA
StrCmpNIA
StrCmpNIW
StrStrW
wnsprintfA

user32

CharLowerBuffA
CloseDesktop
CloseWindowStation
ExitWindowsEx
GetClassNameA
GetCursorPos
GetDlgItem
GetKeyboardState
GetWindowTextA
LoadCursorA
OpenDesktopA

Sections

.farqt
Size: 40KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.uxmpcr
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xenqt
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ