38a7bb567f8de781aad0a267eafb94ab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38a7bb567f8de781aad0a267eafb94ab_JaffaCakes118
Size

500KB
MD5

38a7bb567f8de781aad0a267eafb94ab
SHA1

17d008bc1f0a547d4388729041411746df79b958
SHA256

1201321c8641769c6f0c7a88b8d327e6815badeb2dea09690f3daf1d64608d0a
SHA512

77474b15a231bfe80e3ab3c8df60bc616bf64cef8cfa2fc8b558c2ce33bf169456db580d125665cce5b1cd537aa4f2b4ac503ce034e8e5f3ef89c144b2efeb07
SSDEEP

3072:JlMANAPNNb2eJGkvbTzQf/mrQQXLiHJO8KTxi:JJNALSsLa+ru0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38a7bb567f8de781aad0a267eafb94ab_JaffaCakes118

Files

38a7bb567f8de781aad0a267eafb94ab_JaffaCakes118
.exe windows:5 windows x86 arch:x86

51e3305386def113e11e12fef787e19a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

3Vv@p=i8qg.ylQJxx!l.pdb

Imports

msvcrt

ungetc
fgetws

kernel32

GetModuleHandleW
FlushProcessWriteBuffers
GetNamedPipeClientProcessId
FlsFree
IsValidLocale
lstrcpynA
GlobalFindAtomA
FindResourceExA
GetVersion
GetVersionExW

advapi32

DeregisterEventSource
GetCurrentHwProfileW

gdi32

GetDIBColorTable
DeleteEnhMetaFile
GetMetaFileA
GetMiterLimit
GetBkColor

user32

GetMessageExtraInfo
FlashWindow
GetPriorityClipboardFormat
GetMenu
CloseClipboard
PackDDElParam

oleaut32

VarCyMul

wininet

CreateUrlCacheEntryW

Sections

.text
Size: 468KB - Virtual size: 464KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ