3e70eaf14c732e87162acac9450aeb8a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e70eaf14c732e87162acac9450aeb8a_JaffaCakes118
Size

192KB
MD5

3e70eaf14c732e87162acac9450aeb8a
SHA1

b306e5b83929a500f28c8cd12ed8c27824e8d407
SHA256

4597f5c314db2251826a58cda00d7a3d7fbcdbb10c17cd154dd6907778d55819
SHA512

2abdc4f21c0ba29370ad83412c3178a207569fd00c640dcb640951683244e7f6a7f9cea93327660f654406a5ed5bf34fa2fb54c28f1c51e3a7dae1f0b042344f
SSDEEP

3072:lCjAjLI6111111111111111111111111111111111111111111111111P111111T:3I26m90zYM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e70eaf14c732e87162acac9450aeb8a_JaffaCakes118

Files

3e70eaf14c732e87162acac9450aeb8a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3fb7fe74af0ef407a599f3daceac819e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetACP
LoadLibraryW
InitializeCriticalSectionAndSpinCount
SetProcessWorkingSetSize
GetFileType
GetConsoleMode
FlsFree
GetWindowsDirectoryA
LoadLibraryA
RaiseException
GetLastError
InterlockedExchange
lstrlenA
CancelIo
GetModuleFileNameW
LocalAlloc
LocalFree
GetProcAddress
FreeLibrary

shlwapi

SHCopyKeyW

msi

ord30

gdi32

EndDoc
GdiGetBatchLimit

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ