026992e674749fe77233ca04125e6de0_JaffaCakes118 | Triage

Sharing

General

Target

026992e674749fe77233ca04125e6de0_JaffaCakes118
Size

1.0MB
MD5

026992e674749fe77233ca04125e6de0
SHA1

63185840bfbb1ed5ed02b5afc7b85d6beff8ac19
SHA256

981517581be6937962feaaa3986f9bf835829c6fa33373a9d3d5ff8b45ba2e5f
SHA512

80c2f0196b2423bb64572ea2582b6026ee20106a289345d53051347903dd876faca73e3341774fd5f01c8a2585f65f19fbf1c94a2d97e25f7edfa184542e44fe
SSDEEP

1536:DN8qlbO8TmUlgRJvY21fkSBB+TE3tgSF/dOXz25Q/dGhWd:Z8qlbOOqJgTpI3Dg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
026992e674749fe77233ca04125e6de0_JaffaCakes118

Files

026992e674749fe77233ca04125e6de0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a510baa3ecd268c6c6bb7d395fef0aad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

shlwapi

StrToIntA
wvnsprintfA

kernel32

lstrcmpA
lstrcmpW
GetCommandLineW
GetModuleFileNameA
GetProcAddress
LoadLibraryA
ExitProcess
lstrlenA
lstrcpyA
GetModuleHandleA

user32

PostQuitMessage
DestroyWindow
PostMessageA
GetWindowTextA
DestroyIcon
DispatchMessageA
TranslateMessage
GetMessageA
GetCursorPos
CreateDialogParamA
RegisterWindowMessageA
EnumWindows
SetForegroundWindow
TrackPopupMenu
DestroyMenu
wsprintfA
MessageBoxA
CreatePopupMenu
LoadIconA
EnableMenuItem
InsertMenuA

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey

shell32

CommandLineToArgvW
Shell_NotifyIconA

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ