f2f9628bcf6f9793f3ae42ac44100e28_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f2f9628bcf6f9793f3ae42ac44100e28_JaffaCakes118
Size

803KB
MD5

f2f9628bcf6f9793f3ae42ac44100e28
SHA1

b287276f7bd95ca636bdda2200095fa5fba291b3
SHA256

661f9e8946892c15d0681493a42881225350ddd77202b0ee82af2b4b742202a6
SHA512

01a67094456cc1f76e1edb9d2bb3d116640df854850218c94c3f6e5d12b91d41509f49678931d3c3a906a987582eadf6afebf14fb0234888ab7971679419bc5c
SSDEEP

24576:cFOz15bjcy7/a7KFiLrZ962EJgky92MKZTh:coF3i7ZagkVMCV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2f9628bcf6f9793f3ae42ac44100e28_JaffaCakes118

Files

f2f9628bcf6f9793f3ae42ac44100e28_JaffaCakes118
.exe windows:4 windows x86 arch:x86

21152e6e0c27eabe3cda98deeda19118

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
LoadLibraryW
HeapCreate
SetLastError
GetCommandLineA
GetComputerNameA
GetCurrentThreadId
GetModuleHandleA
LocalFree
UnmapViewOfFile
GlobalUnlock
FindResourceW
CreateProcessA
CreateFileW
CloseHandle
lstrlenA
GetCurrentDirectoryA
PulseEvent
FindClose
lstrcpyA

user32

CallWindowProcA
SetFocus
CreateWindowExA
GetCaretPos
GetDC
DrawMenuBar
CreateIcon
DrawEdge
FillRect
CheckRadioButton
DispatchMessageA
GetDlgItem
IsWindow

cryptui

LocalEnroll
CryptUIDlgSelectCA
CryptUIDlgSelectStoreA
CryptUIDlgCertMgr
WizardFree

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 793KB - Virtual size: 796KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE