278c40428bcdaf1e5de04ced049aa056_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

278c40428bcdaf1e5de04ced049aa056_JaffaCakes118
Size

42KB
MD5

278c40428bcdaf1e5de04ced049aa056
SHA1

ba2c213ac6405a2e171af4a91a1df68a9f4dd107
SHA256

bb35e9e4cfd87fa64a70328f3b950725bc5a5694c4fd4e6bfc0d7558688be591
SHA512

f936a880370304c88dd04be141224dd867c3ad4370b90058e2661bb4dc7bd6a52338aadc350bacba61037dd3ac0517386ec99473624eb91e9da78dc7817dea86
SSDEEP

768:a6MI3/zaVviBmX8kiDWdBNA8DJu3eFbNBoebx2WSLI2AM3UiR:fPzAviBmODWxP49LIKp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/shablonoff.exe

Files

278c40428bcdaf1e5de04ced049aa056_JaffaCakes118
.rar
shablonoff.exe
.exe windows:4 windows x86 arch:x86

045d4163a589d13b9968e36d7f1eb6ab

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualProtect
GetModuleHandleA
lstrlenA
lstrcatA

gdiplus

GdipSetStringFormatLineAlign

ole32

WriteOleStg

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ