059787d6d29ddc60a4c85d3ac26c2ae0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

059787d6d29ddc60a4c85d3ac26c2ae0_JaffaCakes118
Size

77KB
MD5

059787d6d29ddc60a4c85d3ac26c2ae0
SHA1

32a8424af9949ea05509f5ac6a244515463ac5a1
SHA256

e486d7548068da8b544606f9da083de6cf65c8327913fc6ee1defa73d4e4516f
SHA512

7eca3eb385d39356792a09016ad877ff97c6b3cf0f28a496632785548a2b9883121067fe0ec2f6ffb47d305c5b26d4db2aaf3d03415e188f1b4116daf98ef52f
SSDEEP

1536:TNBx25QQImTci1QTZsVnRXS5AWIExtk+s20mRuYWE:TNBI2QhTbqZsV0RluYWE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
059787d6d29ddc60a4c85d3ac26c2ae0_JaffaCakes118

Files

059787d6d29ddc60a4c85d3ac26c2ae0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

281e8a0f2402171fc531c64016d90feb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ConvertThreadToFiber
GetConsoleCP
VirtualProtect

shell32

ShellHookProc
StrRChrIW
SHGetInstanceExplorer

Sections

.text
Size: 42KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ