0b770e498071fa279cf36d0e39afbc26_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b770e498071fa279cf36d0e39afbc26_JaffaCakes118
Size

163KB
MD5

0b770e498071fa279cf36d0e39afbc26
SHA1

9703b277d8da25fc65ecb57bc2d335a841e6f474
SHA256

599c55b9165d999b9baf56c85e301220f2d680a13279d24f8227335f93e01be7
SHA512

d4495f44c019450ed5008fad5d799dba40370803297d193e26f79d6b46cf3422c5d3de1e69ee3a55c4b29fd2735e461cfbcb6b6dd067d2c2693190994f895893
SSDEEP

3072:iy2dLlMSznkKecXUw4PZXnlyEllrhRUvCDY8Y:i5dxM4kK9iVy+lrzMCd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b770e498071fa279cf36d0e39afbc26_JaffaCakes118

Files

0b770e498071fa279cf36d0e39afbc26_JaffaCakes118
.exe windows:4 windows x86 arch:x86

026dc4c7899ae155c7652b8a6e6792c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

LresultFromObject

user32

CreateWindowExW
GetWindowInfo
GetUpdateRgn
EndDialog

kernel32

PrivCopyFileExW
CreateFileMappingA
GetProcessId
MapViewOfFile
EnumResourceTypesA
ExitProcess
AddAtomW
DeleteAtom
ProcessIdToSessionId

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ