add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118
Size

458KB
MD5

add970c41dfeceacf5542a2f0b3e7f72
SHA1

839040ec19fa5bddd297b4402f08b69f00560f9e
SHA256

f9a68d9d091f067c91039866f4460ffdef9f5fa13f3329cf7e349857bca89016
SHA512

8ca6d581e4e0ce3d4c5e456489e17e011b3b2646172ab31eb894d3fb8e973b27425c5d30ad70fb618fad76ed94c02a625bbe0c95bdb48904181bbbd91c54b699
SSDEEP

6144:D1Aik1Ud7Tlwm26bX+hlxQzWgjRtTdSHPM:JAikyXOm2IX+7xQa0JMM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118

Files

add970c41dfeceacf5542a2f0b3e7f72_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6ffcd1f8e54c78e4234e7d8e51232382

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

herklLEGHKWR#;3kl.pdb

Imports

gdi32

CreateBrushIndirect

msi

ord30

kernel32

SetSystemFileCacheSize
IsWow64Process
DeactivateActCtx
GetModuleHandleA

advapi32

QueryUsersOnEncryptedFile

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 177KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ