508f6f7e7d14d03ea1251d23179fca18_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

508f6f7e7d14d03ea1251d23179fca18_JaffaCakes118
Size

20KB
MD5

508f6f7e7d14d03ea1251d23179fca18
SHA1

eacec33587b9738f685126a1d3c378f7f8a0aa17
SHA256

a6b98a5d46d5cf871c0b14912b0690af4d0cc17caeb68af62eca5f5575a3f59a
SHA512

1e0eb2f8717bd13c38784184954336fcb0a93c7a347a299569fc1bc6ec64bec5d91b99984640045673a93f2263d72aa1ec4bbd1d89970df5edb3018260d921ac
SSDEEP

384:zRQCTIZq6FPg6ItLG3h/TvtQVdMIO3oouUB+VDhh7vvxlL/4WYTjWs:DTT3tqx7FwnOLBKhh7DOl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
508f6f7e7d14d03ea1251d23179fca18_JaffaCakes118

Files

508f6f7e7d14d03ea1251d23179fca18_JaffaCakes118
.exe windows:6 windows x86 arch:x86

4ccd08db6587191c2d421a96ca4b97ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

advapi32

StopTraceW

gdi32

BitBlt

user32

GetDC

msvcrt

exit

shlwapi

ord176

ole32

CoInitialize

api-ms-win-core-path-l1-1-0

PathCchAppend

ntdll

RtlNtStatusToDosError

comctl32

ord334

shell32

ord155

Sections

.MPRESS1
Size: 12KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE