ed636b2c1820bc74650ba9c466abd84a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ed636b2c1820bc74650ba9c466abd84a_JaffaCakes118
Size

39KB
MD5

ed636b2c1820bc74650ba9c466abd84a
SHA1

88712988fdb9f9b4faafcf9fe39300452de42a7f
SHA256

90d6a10e0c0c9130e38e09274c491522f51f0ac0ca2d3f26b6ece525aeb28496
SHA512

0503f712ba39cb7a9611fe3ded469d399ac7f9f4bbaf8e9b4aff7fcd2fae6238599361ee2a672186972d9a04ff418ccec29a86933e0cf0269a9fabfbd8ba599c
SSDEEP

768:+FX537242RJ5UkRqm+rzwriY5CYP7fc+ypnJft37eo7fk/f26WG/Edw:eXF7LUwy6oriY5CMnyBBt37r8uHsEG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ed636b2c1820bc74650ba9c466abd84a_JaffaCakes118

Files

ed636b2c1820bc74650ba9c466abd84a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2a5a1364d06dec60391fb3924d5d8592

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BackupSeek
ExitProcess
GetLogicalDrives
GetPrivateProfileSectionW
InitializeCriticalSection
OpenFile
SetVolumeLabelA

advapi32

AdjustTokenGroups
BuildImpersonateExplicitAccessWithNameA
CryptDuplicateKey
CryptGetDefaultProviderW
GetTrusteeNameW
LookupSecurityDescriptorPartsA
RevertToSelf
SetEntriesInAclW

gdi32

CreateDIBPatternBrushPt
DeleteEnhMetaFile
EnumObjects
ExtTextOutW
GetCharWidthW
GetEnhMetaFileDescriptionA
GetKerningPairsA
GetTextFaceA
OffsetViewportOrgEx
PlayEnhMetaFileRecord
PlayMetaFile
RemoveFontResourceW
SelectPalette
StretchBlt

Sections

.text
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE