fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118 | Triage

Sharing

General

Target

fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118
Size

829KB
MD5

fa00d610121f6bca2227ad2cdcaa9c87
SHA1

1d63a7a933aeeb40d53254651c0bb1188a59859b
SHA256

863af398152dd47dec84afd9ded8de26b4d4cac1bbc3c46843608bf040b426c3
SHA512

3936e9a43cb782897b6e0da52edace5031dbf92c5932081128d95dedd0f0b1a02ca25fa44c1d41a24c4a2056b454ab458c5cd024f3df22b8db5f6f08f93b6022
SSDEEP

24576:Z6o7JPnoSFnyconmKXVAlx1KISt/fpvrMVm7Z:b7J/oSF4ndVATM5fpvrP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118

Files

fa00d610121f6bca2227ad2cdcaa9c87_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9072a2abb33de32509d1050f2abb3542

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetSystemDefaultLangID
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetProcAddress
LoadLibraryW
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetSystemTimeAsFileTime

shlwapi

SHDeleteKeyA

shell32

CommandLineToArgvW

sensapi

IsNetworkAlive

comctl32

PropertySheetW

Sections

.text
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 400KB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ