b752daf307f20eea04d48005169f3479_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b752daf307f20eea04d48005169f3479_JaffaCakes118
Size

20KB
MD5

b752daf307f20eea04d48005169f3479
SHA1

25afbcaaaf68cf903e53794661a7e6838506b149
SHA256

1a26a47b21fcfb707b1a5198d9ad2aba1ed7deb10cf8255c175b95378097415d
SHA512

da4617c09c11203d0f9afd09ca3e28db95c82fe0ce2bd60146949fafbf095651fb70eb6fcb83090a5a05f518a945d9660569e918fc5d14de58b629883189abf2
SSDEEP

384:2T+2iTZWK6FbsfgGEw/u4YyyDuLccs+jefz7vvxlLSvu:2a2iTZWMgGfuwAcm66z7DSvu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b752daf307f20eea04d48005169f3479_JaffaCakes118

Files

b752daf307f20eea04d48005169f3479_JaffaCakes118
.exe windows:5 windows x86 arch:x86

11f5e2ea1079f3450086d7864bd3a2f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

appinitializerlib

??0CAppInitialize@@QAE@XZ

afcore

??0BString@@QAE@XZ

shlwapi

PathCombineW

user32

SetTimer

advapi32

RegCloseKey

ole32

CoInitialize

oleaut32

SysAllocString

msvcp90

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

msvcr90

exit

Sections

.MPRESS1
Size: 14KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE