0b47c4a984bde79b23cba3451d617330_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b47c4a984bde79b23cba3451d617330_JaffaCakes118
Size

851KB
MD5

0b47c4a984bde79b23cba3451d617330
SHA1

5f2bcf5fae841e9d4e4120bf917e24cb770b0e15
SHA256

fb5efb61277f99b38ef71a2f338f2d1b75b4a4ecf70ec2d54759146135ebb972
SHA512

438fdccd376f19f8cb8a6768b8f8e599f61e6a26d3ecf37d4d67a35d2fdffb74ce95d58327138baea9cf57d7ef24a3737ff23f8206f336fe2a08dfb3c1c61b45
SSDEEP

24576:cVMpx39iQsEBTYGolw/8zdrp/cQuG17/Up:c6iQN+qMdjug

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b47c4a984bde79b23cba3451d617330_JaffaCakes118

Files

0b47c4a984bde79b23cba3451d617330_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8493ffb7686e6dfc42f355e1d6a7d57e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
DeleteAtom
GetFileAttributesA
HeapDestroy
GetStartupInfoA
GetCurrentProcessId
GetStdHandle
GetPriorityClass
GetCommandLineA
CreateMailslotW
FindAtomA
GetProcessTimes
DeleteFileA
CloseHandle
GetEnvironmentVariableA
IsBadCodePtr
SuspendThread
GetModuleHandleA
HeapCreate
ReadFile

user32

GetWindowInfo
SetFocus
GetClassInfoA
GetWindowLongA
GetClientRect
CallWindowProcW
DispatchMessageA
DispatchMessageA
GetKeyState
IsZoomed
DrawTextW
GetSysColor
DestroyMenu
DestroyMenu

msctfp

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 843KB - Virtual size: 842KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ