0c174b09f22265a937e5969f41232c94_JaffaCakes118 | Triage

Sharing

General

Target

0c174b09f22265a937e5969f41232c94_JaffaCakes118
Size

35KB
MD5

0c174b09f22265a937e5969f41232c94
SHA1

1c0ab2c187d89742a882c4332a19c944207b7cbc
SHA256

f1c53ac181456a1212fad9c313ea10a3cdd152a2dc33dd5ff5d9a89c2a67c6f2
SHA512

542fbacc5d0a340f6a9621e888c586bc2d74e481e98a13f0703c638ed98d40c8360bdb2ed814c25582fc51cc9a0538ecff7d96fcd0967404b051ee74e0652391
SSDEEP

768:xdLf7gPwb9Tzt1oshhhT37lR9HXwon1mgOq:82kshhhbhRrnN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c174b09f22265a937e5969f41232c94_JaffaCakes118

Files

0c174b09f22265a937e5969f41232c94_JaffaCakes118
.exe windows:0 windows x86 arch:x86

8ae07bf2db2a1e760f0751ebf0612494

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlPcToFileHeader
NtSetHighWaitLowEventPair
NtRaiseHardError
RtlQueryProcessHeapInformation
ZwAllocateVirtualMemory
NtSetEaFile

kernel32

GetLocalTime
GetFileTime
ExpandEnvironmentStringsA
GetModuleFileNameA
GetVolumeInformationA
GetCommandLineW
lstrcpy
CompareStringA
Beep
SetCurrentDirectoryA
lstrcpyA

user32

LoadCursorA
OffsetRect
CharUpperW
LoadMenuIndirectW
GetMenuItemID
mouse_event
AppendMenuW
SendMessageA

gdi32

Ellipse
CreateDIBitmap
CreateCompatibleDC
CreateDCA

advapi32

RegDeleteValueA

comdlg32

PrintDlgExW
FindTextW
PrintDlgA
ReplaceTextW

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ