2467c1712fc7f26fc4711018597ace38_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2467c1712fc7f26fc4711018597ace38_JaffaCakes118
Size

92KB
MD5

2467c1712fc7f26fc4711018597ace38
SHA1

8003adb0b72f91240f2fa0465948a34beffb5422
SHA256

86fb1edbc3bb825ea2515e77e1095a291db613a31890349ecd2b0d1ca67f829c
SHA512

02554d5959ecd7a37bce518c81d03ef4cbc44bfaf6729a887ac7d828330465c4288c1cb7a6ae65f9edb5d268cc3ca354ef66b22763e211307b478abc66550cd0
SSDEEP

1536:bDZQRzbDBWBUHA4hSgKbtdhV3Fzgv6oAiJpmcuVD/ENg/zz:hQRbB0UH/wdp83RJpmcu5x/zz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2467c1712fc7f26fc4711018597ace38_JaffaCakes118

Files

2467c1712fc7f26fc4711018597ace38_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fe117f5440df727b8c3e67359dfd3b3e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetSidLengthRequired

kernel32

WTSGetActiveConsoleSessionId
GetThreadLocale
GetCurrentProcess
LocalAlloc
LocalFree
GetSystemDirectoryA
FreeLibrary
InterlockedExchange
GetLastError
LoadLibraryA
RaiseException
GetSystemDefaultLangID
GetProcessHeap
SetFileApisToOEM
GetSystemDirectoryW
AddAtomA
ConvertDefaultLocale
GetCurrentProcessId
ScrollConsoleScreenBufferA
DecodePointer
GetProcAddress

cfgmgr32

CM_Is_Dock_Station_Present

clusapi

ClusterResourceOpenEnum

msvfw32

ICGetDisplayFormat

avifil32

AVIClearClipboard

gdi32

ResetDCW
StartDocA
GetTextFaceA

ole32

CLIPFORMAT_UserMarshal

oleaut32

VarR8FromI4

setupapi

SetupDiEnumDriverInfoW

msacm32

acmDriverClose

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ