f967ad576306c4cf61436c52d61ebf9e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f967ad576306c4cf61436c52d61ebf9e_JaffaCakes118
Size

165KB
MD5

f967ad576306c4cf61436c52d61ebf9e
SHA1

a081e74fe21864bc480d697f05d11ab53764aadf
SHA256

bdd6db2832b872eedd2274d3a66658462f53b869766bf2c808be6cf1efd22571
SHA512

34491d1955f75731f645b9acad21ababed5e79c48b6e056369fc04b4cadedf6d8018185daa58e99e6dde420e7619f44b8f4134afd77a2b34729b71801f02d191
SSDEEP

3072:/fURrroNs0tIoQL3Ok43uqnJ6wRhIkkrZ8DhGs1j3/rPgixZzVu3jkHlP:kx6s0tIJVVqnJ6+IkWZ8DYsJTYixeTkR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f967ad576306c4cf61436c52d61ebf9e_JaffaCakes118

Files

f967ad576306c4cf61436c52d61ebf9e_JaffaCakes118
.exe windows:5 windows x86 arch:x86

061641c9b78d67f3a4f039d9f15bff37

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualProtect
VirtualAlloc
VirtualFree
ExitProcess

advapi32

RegCloseKey

comdlg32

ChooseColorA

gdi32

SaveDC

msacm32

acmMetrics

msvfw32

ICInfo

ole32

CoGetObject

shell32

DragFinish

user32

GetDC

winmm

mixerOpen

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.RLPack
Size: 54KB - Virtual size: 103KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ