ed610c643e489255bad7378985798f74_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed610c643e489255bad7378985798f74_JaffaCakes118
Size

399KB
MD5

ed610c643e489255bad7378985798f74
SHA1

d694a619d8841c517497d2e75b53e1eea1b44340
SHA256

ea21df4f189a4f37a5516d72c1e91a60a3bf1ba03d8b27b8d27ea437de6ef51a
SHA512

59591f27fd78eb9e1e5dd625d6a4cd7ab3ee7bef83f4747d547eaed038bfc92ecf1359e236be4464f1d42beb7bd41ff5f63e183a4689e2673f5aa41e856d1381
SSDEEP

12288:A5VBzh5kD9kL/uu5FrH6Vd7T+4yLEDAE6:A5VNhCu+BT+4q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed610c643e489255bad7378985798f74_JaffaCakes118

Files

ed610c643e489255bad7378985798f74_JaffaCakes118
.exe windows:5 windows x86 arch:x86

8500f3c5031456023c517f1f9846cab1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoAllowSetForegroundWindow
DllDebugObjectRPCHook
HICON_UserSize

kernel32

WaitForDebugEvent
UnhandledExceptionFilter
GetLastError
GetStartupInfoA
GetVersion
SetLocaleInfoA
FindFirstVolumeA
GetComputerNameExA
VirtualProtect

gdi32

GdiCreateLocalMetaFilePict
PATHOBJ_vGetBounds
GetOutlineTextMetricsA
CreateFontIndirectW
GdiGetLocalBrush

Sections

.text
Size: 394KB - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ