07bc183e3343968ca8e9077c4156e4af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

07bc183e3343968ca8e9077c4156e4af_JaffaCakes118
Size

150KB
MD5

07bc183e3343968ca8e9077c4156e4af
SHA1

bc772d3409b8c95750dae5039aaf545b48a70f0d
SHA256

cf39b40c5896f66dac41c4f431876aeff2c98182f8ee7a2b8c4bbb305428f758
SHA512

eeba688a5ea72a34e19c18a58414cd98464080cfed69e2025d988154ef66515350ee6a520913a78b6740fd14520dc011231456b2a90b2d5607a9509024ae1331
SSDEEP

1536:MLHvv4a3pfYRPitWq7KT7cjQCyR9fAjM4Ss21AWnStO/PzYJ2ZhP:MDvv4aZfEPitWq73QC24HHRmokbr3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07bc183e3343968ca8e9077c4156e4af_JaffaCakes118

Files

07bc183e3343968ca8e9077c4156e4af_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc60a920495dd603b6329f9f82fb28de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Acro_root_apms\build\Release-results\info\template.pdb

Imports

kernel32

GetModuleFileNameW
GetProcAddress
LoadLibraryW
HeapFree
GetFileAttributesW
HeapAlloc
GetProcessHeap
GetCommandLineW
SetStdHandle
ExitProcess
CreateFileW
GetModuleHandleW

shell32

CommandLineToArgvW

msi

ord173
ord205

user32

MessageBoxW

shlwapi

AssocQueryStringW
StrCmpW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 63KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE