47f9d4a2fe5af57864029ab4b65f0f0c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

47f9d4a2fe5af57864029ab4b65f0f0c_JaffaCakes118
Size

52KB
MD5

47f9d4a2fe5af57864029ab4b65f0f0c
SHA1

b096e37c4ddda82c760bad60825549a345a3de79
SHA256

2bfcd9f7eba2b41e52f3e7e690adbc7ee36d9c3d3ddd9d06f0730ed0088bbd79
SHA512

1cd9c1fada3d543cceba4ad16943f44dc1f6aafcfbe8376352874b1f2136b5009ebbb9f34170952cbd7428c93b24424356b3d4c0ba1c258b5621be02eef6b683
SSDEEP

768:FcsgYaXceUC3phHvKebcyLV8Roqvbq5b5U/02MgcQImByg8UOFsiCWU5kxEAVx6M:FrghXceUCzHWw+mL5q9LkFFIkxEAvZMy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/documenty.exe

Files

47f9d4a2fe5af57864029ab4b65f0f0c_JaffaCakes118
.rar
documenty.exe
.exe windows:4 windows x86 arch:x86

cb5c7c772aed527e4e27365e2a419dff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetCapture
GetKeyboardType
GetActiveWindow
GetMenu
GetAsyncKeyState

kernel32

LoadLibraryA
VirtualProtect
GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
lstrcmpA
GetConsoleCP
GetCurrentThreadId
lstrlenA
lstrcatA
GetACP

oleacc

CreateStdAccessibleObject

version

VerQueryValueW
VerInstallFileW
VerFindFileW
VerFindFileA

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ