f9941eab096b5888b49d5513f8bf0cf8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9941eab096b5888b49d5513f8bf0cf8_JaffaCakes118
Size

352KB
MD5

f9941eab096b5888b49d5513f8bf0cf8
SHA1

fa85408d6fdf6f5ddf7dde05b7589e724dfa731d
SHA256

f1785cdd985f9f4bd5446e1855164f4164a346f6fe849482ec1258f3e361a06b
SHA512

455059f8ae119bebfdf909216e4581ad1ef27aa1a835a618cfb41b13bbb0d6203455762499508d0c29afa1b27f75e179403d2490fd64ff09af5fa061e18ca185
SSDEEP

6144:YuUvy1wBYyaIiV7mA6XKKfJXJStfXDbMZuFs9m89umpIeltepCeoN:Gvy1wBYvIiV7mA6XLGt0FYOIot3em

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9941eab096b5888b49d5513f8bf0cf8_JaffaCakes118

Files

f9941eab096b5888b49d5513f8bf0cf8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3103d0e0d01f81ce34ae977817677c0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
SetErrorMode
CreateMailslotW
EnumCalendarInfoW
FreeLibrary
LoadLibraryA
IsBadCodePtr
UnhandledExceptionFilter
GetEnvironmentStrings
GlobalFlags
GetWindowsDirectoryA
VirtualQuery
SetHandleCount
LCMapStringA
GetModuleHandleA
GetTickCount
InterlockedExchange
LocalFree
InterlockedDecrement
LocalAlloc
GetThreadPriority
GetCurrentThreadId
LockResource
GetVersion
CloseHandle

oleaut32

LPSAFEARRAY_UserFree
CreateErrorInfo
VarUI1FromI1
GetErrorInfo
SetErrorInfo
VariantInit
SysFreeString

userenv

RegisterGPNotification
UnregisterGPNotification

Sections

.text
Size: 222KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE