a481fa5fd8406791dd2ee4759f814e20_JaffaCakes118 | Triage

Sharing

General

Target

a481fa5fd8406791dd2ee4759f814e20_JaffaCakes118
Size

573KB
MD5

a481fa5fd8406791dd2ee4759f814e20
SHA1

5ae4aa31489683ed4a868c552d571b52f54dfd80
SHA256

8ac84171989ed2e1e6a6737e3be5da82963f32c146bbd0e64f7482201166c043
SHA512

4ba64bb4125070a7a2613e6bd05e17663d088304cfbe3ee6d8d6cfdc733b6f82e4fa42a86dbce35c11a324651c5f7f374fb2d6c81a5b2bfde481bd3c822f20d8
SSDEEP

6144:4lBSj0U5A+/lKQUTtu9EF9FKU+5uT65dlRZnSiU:ASj0AAklKR5uUv+5a6Z5U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a481fa5fd8406791dd2ee4759f814e20_JaffaCakes118

Files

a481fa5fd8406791dd2ee4759f814e20_JaffaCakes118
.exe windows:4 windows x86 arch:x86

21001bcd9eb8937e7de7822e8b7ed58e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

GetDC

gdi32

SetBkMode

shell32

ShellExecuteA

advapi32

RegCloseKey

comctl32

ord17

ole32

CoTaskMemFree

version

VerQueryValueA

Sections

.MPRESS1
Size: 17KB - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 551KB - Virtual size: 551KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS1
.MPRESS2
.rsrc/GROUP_ICON/103
.rsrc/ICON/1.ico
.rsrc/ICON/2.ico
.rsrc/ICON/3.ico
.rsrc/ICON/4.ico
.rsrc/ICON/5.ico
.rsrc/ICON/6.ico
.rsrc/ICON/7.ico
.rsrc/ICON/8.ico
.rsrc/ICON/9.ico
.rsrc/MANIFEST/1
.xml