4959c2c4aacd2f564c2058f45ae91aa0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4959c2c4aacd2f564c2058f45ae91aa0_JaffaCakes118
Size

64KB
MD5

4959c2c4aacd2f564c2058f45ae91aa0
SHA1

6c172a557934e0b0a991743f5a0eea99caf6d3f0
SHA256

e0cddc0baf4547b5021c6be5b2cab3ce68881d253ebef93a57e9a7d945a13e43
SHA512

31f5d46735739507331975e7becdc57783e8e0913a67e2f17c12634d67b1d6643b62bd8b7725ee103df92d214b9757ae595fd7940e04fd397c70fd1dd49faac6
SSDEEP

1536:Km1GTxx9xP8CAvjw82LFOwGkCf/u5ajZ+0k:ngv9Z8CWcF5amaZ+0k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4959c2c4aacd2f564c2058f45ae91aa0_JaffaCakes118

Files

4959c2c4aacd2f564c2058f45ae91aa0_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9c89e30a54ff39baf50f19eff6054a95

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

RegCloseKey

comctl32

InitCommonControls

gdi32

BitBlt

shell32

SHGetMalloc

user32

GetDC

winmm

PlaySoundA

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__DebuggerHookData
__GetExceptDLLinfo
___CPPdebugHook

Sections

.MPRESS1
Size: 55KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE