09ba797085882ef7121e4790087be200_JaffaCakes118 | Triage

Sharing

General

Target

09ba797085882ef7121e4790087be200_JaffaCakes118
Size

639KB
MD5

09ba797085882ef7121e4790087be200
SHA1

45d8a04c7c36ffbec266b7bed468f1846275d4e5
SHA256

294294d1d2eeb1f393dc82db9ed6d8c05a1a86fae57c51b6eb7cd0139d649342
SHA512

376c308767fd5a449c6f94e473cbea338101a432bfb5cc1159892f853b964849dc1a804ce22eba49a0fd5fa9d7b8dc7109477fb7ac93cf5343c02166e1ac40b1
SSDEEP

12288:OCuBTNphIjfhpkXUP7ntAYGyW9ZEk47YbKbJYEIwaL9:oQDhSXubW9iB0bKO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09ba797085882ef7121e4790087be200_JaffaCakes118

Files

09ba797085882ef7121e4790087be200_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e02f2138143f236d72e14a6263b7c730

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetKeyboardLayout
GetDoubleClickTime

shell32

SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

StrStrA
StrChrIA

kernel32

GetModuleHandleA
lstrcpyA
lstrcatA
WriteFile
Sleep
SizeofResource
RtlZeroMemory
LockResource
CloseHandle
CreateFileA
ExitProcess
FindResourceA
FreeLibrary
GetCurrentDirectoryA
GetModuleFileNameA
LoadResource
GetProcAddress
GetTickCount
LoadLibraryA
lstrlenA

urlmon

IsValidURL

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 623KB - Virtual size: 623KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE