fd523b35547f833f5c79d47463842db4_JaffaCakes118 | Triage

Sharing

General

Target

fd523b35547f833f5c79d47463842db4_JaffaCakes118
Size

152KB
MD5

fd523b35547f833f5c79d47463842db4
SHA1

ee94ff90c491974e8204c15cdfb2a17074680c1a
SHA256

7a71ec02644aea328d0bec795c99dec0355b3d43306613da7352e10ccd208f4a
SHA512

7e80920026378fff9c3fe9a7de7c0d0f06f9c9c6341869b81ff4ec5e0673aa70d2bb9a3c798d83f54bcfb43bce1df8f35a8a1672b760ac9d729bc58d76425a3f
SSDEEP

3072:auwu8hZASuwU3sisEFqzygQHn6pwvYuqDuX8Ic6W1hHApr4Y3:auwu8hyHwUcisu0ybn6MvWs8B6cKZd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd523b35547f833f5c79d47463842db4_JaffaCakes118

Files

fd523b35547f833f5c79d47463842db4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4b3add7a2acbb913d6b8d3b6b851b0ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlNewSecurityObjectWithMultipleInheritance
RtlMultiByteToUnicodeSize

user32

RealGetWindowClassA
LoadBitmapW
GetSysColorBrush
ValidateRgn

advapi32

ProcessTrace

gdi32

WidenPath
UpdateColors
UnrealizeObject
SetPolyFillMode
GetPolyFillMode
SetMapMode
SetDCPenColor
SetBkColor
PathToRegion
LineTo
InvertRgn
IntersectClipRect
SetMapperFlags
GetFontData
DrawEscape
Ellipse
EnumFontsW
ExtSelectClipRgn
FrameRgn
GetStockObject

dinput

DirectInputCreateEx

shlwapi

SHDeleteOrphanKeyA

shell32

SHMultiFileProperties

hid

HidP_GetUsageValue

Sections

.text
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE