08535e16836490c4962064e36406e2a9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08535e16836490c4962064e36406e2a9_JaffaCakes118
Size

171KB
MD5

08535e16836490c4962064e36406e2a9
SHA1

21109949b9548fb2b19bf7487cd9575b3351b9b4
SHA256

40e81d5234eaf59071fb77db81242d0f65fc245289d26876025242ffe7ec2e33
SHA512

beff8fc74c6b3216f944c5355f6c60f632c5e25801240fbae35958ee0505b0158fa775095c13e554947fb199d6e7213787bdf940698cbea7879a9dd065dec0ed
SSDEEP

3072:5GdHV73AjwqCrF4VE1CwgqetHfEWk78dsFM24rQSR:5K173AcqCrF4aMwgqep2MpT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08535e16836490c4962064e36406e2a9_JaffaCakes118

Files

08535e16836490c4962064e36406e2a9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b879217b82e80d72e62be0eae3b4f91d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLongPathNameW
InitializeCriticalSection
MultiByteToWideChar
LoadLibraryA
GetFileAttributesA
SetThreadContext
GetProcAddress
GetWindowsDirectoryA
DeleteCriticalSection
DisableThreadLibraryCalls
EnumResourceNamesA
GetVersion
ExitProcess
lstrcpynA
GetModuleFileNameA
InterlockedDecrement
InterlockedIncrement
GetLocaleInfoA

clusapi

CloseCluster

user32

GetActiveWindow
DestroyWindow
GetWindowRect
SetFocus
ReleaseDC
EqualRect
SetWindowRgn
MoveWindow
DefWindowProcA
GetKeyState
GetDlgItem
GetDC
IntersectRect
UnregisterClassA
EndPaint
SetDlgItemTextA
OffsetRect
BeginPaint
SetWindowLongA
LoadAcceleratorsA
PtInRect
CharNextA
SetParent

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ