09e4054f92422ba5a8562d7d63361a42_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09e4054f92422ba5a8562d7d63361a42_JaffaCakes118
Size

787KB
MD5

09e4054f92422ba5a8562d7d63361a42
SHA1

f7b4be33766592a501e869b6daf590fda8aa108c
SHA256

b0993d8fefbebf5882a172a8633e17eafd7d68d2f0b63027707913c6d7302dd8
SHA512

e7ac1a05229e6dbcfacc1f49ee3c5d6ddf1aebb93c295edf912483282eb21308d997b134135296573e2c6e6a8866ec0f6a9f024b4a71628511026ea507cddfdb
SSDEEP

12288:qCtbkP4quP7h3MPW2oD789YxOUoJgLZWzdCHshGLZwlnBQKYbFQ6qXQfNbtKAdl3:pkPh7689YEUMgLQaZ+nW9nf1tKA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09e4054f92422ba5a8562d7d63361a42_JaffaCakes118

Files

09e4054f92422ba5a8562d7d63361a42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28a4c374e1f157e3695f92bfe9ad2e45

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

LocalSize
CreateNamedPipeW
EnumResourceLanguagesA
GetExitCodeThread
EnumSystemCodePagesA
SetConsoleMode
ScrollConsoleScreenBufferA
GetLocaleInfoA
GetPrivateProfileStructW
GetProcessShutdownParameters

user32

CreateIconFromResourceEx
SetScrollRange
EnumDisplaySettingsExA
DrawStateA
UnhookWindowsHookEx
DdeDisconnect

shell32

StrChrW
Control_RunDLLW
InternalExtractIconListA
SHQueryRecycleBinW
StrNCmpW
SHFreeNameMappings
CommandLineToArgvW

Sections

CODE
Size: 9KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 751KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pack32
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE