17afa44a5cf611d29457b9cc609a3ec6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17afa44a5cf611d29457b9cc609a3ec6_JaffaCakes118
Size

152KB
MD5

17afa44a5cf611d29457b9cc609a3ec6
SHA1

3bbf48a25d7919aa05c6db240c1ad2a77d7b62ec
SHA256

54bcceab05a67c909d59660bc344796ce1552c13243726bc1ec54725d792febb
SHA512

e3a2362a704e7dcf2bb1a038a2456459b173cfdb08d11452d02b3fb1bff676ff95b184aae06884a7f4240f800051a591ca2a5751d636678bede185c6eba79366
SSDEEP

3072:P4FydpdwYrMGQJ8RJ62MoIX4yF2/D56QrdKPnlpQtI:P4hcnDBS2bo0K3Qt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17afa44a5cf611d29457b9cc609a3ec6_JaffaCakes118

Files

17afa44a5cf611d29457b9cc609a3ec6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9b690f767a4563c035ecb495cdc4593b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

QPSWCV.pdb

Imports

kernel32

GetCommandLineA
FreeUserPhysicalPages
GetNamedPipeClientProcessId
GetNumberOfConsoleInputEvents
GetQueuedCompletionStatus
IsValidLocale
GetProcessIoCounters
GetCurrentProcess
GetOEMCP
GetSystemDefaultLangID

crypt32

CertEnumPhysicalStore

winscard

SCardGetStatusChangeA

user32

GetSystemMetrics
SendMessageA
MapDialogRect
EndDeferWindowPos
CreateIconIndirect
GetIconInfo
BeginPaint

gdi32

GetObjectType
GetClipBox
SetViewportExtEx
GetDeviceCaps

advapi32

ObjectCloseAuditAlarmA
MakeSelfRelativeSD
CryptReleaseContext

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ