08c2289439f974086e6130eedcd15bd7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08c2289439f974086e6130eedcd15bd7_JaffaCakes118
Size

156KB
MD5

08c2289439f974086e6130eedcd15bd7
SHA1

0db2280ecb41ce4950203a0dbcba5ecc0fca97e9
SHA256

cdd422f685708810d1d5e174115b6b34d18a9e25893d0f972232ce3399c4c5ee
SHA512

c1d471d5a4261735058578db9480c996d3137431898c67a01d7ac807ace5756b619247695b84cea84e778329c53c35154de42aca54f82dbb07adc1f0788a2ee2
SSDEEP

3072:jYCIq0MP7nqX3Ij2u0CQDeNMw25xWeB9KVZ0LrlVnfpZ5pdmjD:jOq0MTnqnICmM7xWeC0LrlhFbI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08c2289439f974086e6130eedcd15bd7_JaffaCakes118

Files

08c2289439f974086e6130eedcd15bd7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

12cbac1d1139ac6bcaec560e63947188

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoW
LocalFree
lstrcpynW
FormatMessageW
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
lstrcpyW
GlobalFree
SetLastError
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedDecrement
CloseHandle
lstrcmpW
ReadFile
SetFilePointer
ExitProcess
RtlUnwind
GetCommandLineA

shell32

ShellExecuteExW

shlwapi

SHDeleteKeyW
PathCombineW

ole32

CoRevokeClassObject
CoQueryProxyBlanket
CoGetApartmentID
OleIsCurrentClipboard
OleInitialize
CoFreeUnusedLibraries
OleUninitialize

Sections

.text
Size: 56KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 314B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ