70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118 | Triage

Sharing

General

Target

70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118
Size

672KB
MD5

70b98c805dd899ab495c8fc05ed764c5
SHA1

d31ac8865116f613474c9c3e94ce2194ba59def3
SHA256

1765e8e86cbf4032c41d7a678289637b8ee5d79c4d0a8c42b9c25477af24daec
SHA512

bf615f3954371b13ab0e4a561db5e5becb8f8f19c27acc838028a555949d427b76f6fc091dd54ef364027d66e41a0bd7791c9f24a96369f29787ae8349399a0d
SSDEEP

6144:udSw4vVxg2WUxHQGDI6NRw4/zJzgwmQ6J:udSJNxg27ZFI6NRNJzBm5J

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118

Files

70b98c805dd899ab495c8fc05ed764c5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

947ba857c57ff59b93fb620ad7c71d28

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

pjZ*6dBR.pdb

Imports

user32

FreeDDElParam
IsWindowEnabled
GetUpdateRect
GetWindowTextLengthA
OffsetRect
GetCapture
GetMenuStringW

clusapi

GetClusterResourceNetworkName

winspool.drv

FindClosePrinterChangeNotification

kernel32

GetDynamicTimeZoneInformation
WritePrivateProfileStructA
GetPrivateProfileIntW
GetTapePosition
GetCommModemStatus
GetCurrentProcessId

gdi32

GetPath
GetFontLanguageInfo
GetTextCharsetInfo
GdiSetBatchLimit

lz32

LZSeek

ntdll

memset

wininet

FindNextUrlCacheGroup

msvcrt

localeconv

Sections

.text
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 120KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ