89e3c3ee86b7348a5cccdc51a6b94224_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

89e3c3ee86b7348a5cccdc51a6b94224_JaffaCakes118
Size

24KB
MD5

89e3c3ee86b7348a5cccdc51a6b94224
SHA1

43be1fd777e3252c8d2828d501a959a146265a94
SHA256

3e70b5bb5ab5c816930f6a0e106c2dc94dc7271494dbfa09b354e88f9b91dea8
SHA512

8900afebabe0c0b1502f64adc44b13b831cc429903f0d16fa4639ee7dfbd4b8d8ad7e5b80cd41d5abed61a36a9aa95d23228696fc0be4fea18c96602366b1bcc
SSDEEP

384:mqydxWaTSJEdpzoUrfsMcCVLQxOZK5H3z9/TElufFHug7vvxlLw4vOXjD:VyjTuETDDc6LkZD9/Al4ug7Dw4vOXjD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89e3c3ee86b7348a5cccdc51a6b94224_JaffaCakes118

Files

89e3c3ee86b7348a5cccdc51a6b94224_JaffaCakes118
.exe windows:6 windows x86 arch:x86

09774e26f909b66d0c4705142511ff82

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

mfc140

ord12074

user32

DrawIcon

gdi32

DeleteDC

shlwapi

PathCombineA

oleaut32

SysFreeString

gdiplus

GdiplusShutdown

vcruntime140

memset

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-string-l1-1-0

_strdup

api-ms-win-crt-stdio-l1-1-0

_set_fmode

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_setmbcp

Sections

.MPRESS1
Size: 15KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE