0b0806b1de0b547896f2e24a5f9b0c3e_JaffaCakes118 | Triage

Sharing

General

Target

0b0806b1de0b547896f2e24a5f9b0c3e_JaffaCakes118
Size

261KB
MD5

0b0806b1de0b547896f2e24a5f9b0c3e
SHA1

1b8d7c98a2093bae2b9644d385119b57933eae1a
SHA256

44f21edd5a9016cc9aecb229c243a88852f046f13b170aa589988bf9c3c4304b
SHA512

3be852411c8663cd313c315d9d3c1f00003ff678dc3ad6b73b204fc5c9c4908211f60236d1b357e5126a37063de33efb1637494c4a9e94f20505948239292022
SSDEEP

6144:EOcOSU1b9ci5xihCff8ptJ0w1Lva3o4T0oKZSlmdEJdVpaF6:EOEUHDyCf0t0crsoho7dXaF6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b0806b1de0b547896f2e24a5f9b0c3e_JaffaCakes118

Files

0b0806b1de0b547896f2e24a5f9b0c3e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cbf47572e8cb446c01bd5522c7d7f827

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\perforce\build\v11.0.0\Obj\Release\shared\shell\unexe.pdb

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
lstrcpynW
GetFullPathNameW
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
WideCharToMultiByte
GetEnvironmentVariableW
GetVersion

user32

MessageBoxA

Sections

.text
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 116B - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE