05574e30f5a96e6b79c71130b6f9ef84_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

05574e30f5a96e6b79c71130b6f9ef84_JaffaCakes118
Size

167KB
MD5

05574e30f5a96e6b79c71130b6f9ef84
SHA1

197b7eeadec97675e9f8bb6d222b850b581a7859
SHA256

2538b4aa2a374c0e8280ee6cc25dc30821c289a73958f30d18155307396eb1f1
SHA512

679dfd0dbb8bb35506d6702c5a241e436e8b49da85dabfba5c198bb1f48d8ca45bf805d26da4ac6ca5a027e4210b79049517047ebf7679e8e475b25f400bbacd
SSDEEP

3072:JpsG2ciA1ifM91rnHbgJt62b2IpZ4ZCYGyXcb3SwYO/KnhAiNX:JpjYAgfM9R7gJb204pcbSw7/KyiN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05574e30f5a96e6b79c71130b6f9ef84_JaffaCakes118

Files

05574e30f5a96e6b79c71130b6f9ef84_JaffaCakes118
.exe windows:5 windows x86 arch:x86

81c31da05b5ebab36c41091841650912

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\jyonCnNpxZlJwh\XatGWiula\ykpwhKiLfNdzPd\adufkrM\dbephmbdM.pdb

Imports

kernel32

SetThreadContext
GlobalMemoryStatus
GetProfileIntA
ResumeThread
GetProfileStringW
ClearCommBreak
GetSystemWindowsDirectoryW
GetShortPathNameW
ConnectNamedPipe
SetupComm

shlwapi

PathUnquoteSpacesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

gdi32

AddFontResourceW
DeleteObject
FillRgn
CreateRectRgn

Exports

Exports

?ToTestFunction@@YGKXZ

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug01
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ