0ce0144f3932bfb03190d45dcbb23609_JaffaCakes118 | Triage

Sharing

General

Target

0ce0144f3932bfb03190d45dcbb23609_JaffaCakes118
Size

187KB
MD5

0ce0144f3932bfb03190d45dcbb23609
SHA1

91c80d592326ac7a26d08105b05c70541a8f2481
SHA256

1383f492715d1e10576250a2af76afb3fafa9aba07608c7a28fe9da272478464
SHA512

0decb20deafbad71967847a7788b4f1ac35d11c835926062ba975c34b6b8b98866fb1041a9cb872824739570ae5efbf106dc5056877f6eb96db9a555badf7ea2
SSDEEP

3072:Ss+W/F2TzNhWsm8aTBZEFOlBZs+LbLGiuIgx+DCUs8uDl4+Ifgt+CHZy9s28:S2+88EGWBZNTukpnuDl4sH5Rf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ce0144f3932bfb03190d45dcbb23609_JaffaCakes118

Files

0ce0144f3932bfb03190d45dcbb23609_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7bb13d922ddb62e106e29237446e3e7e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmAssociateContext

kernel32

GetModuleFileNameW
SetProcessPriorityBoost
Sleep
CreateFileW
GlobalLock
CreateEventW
EnumResourceTypesA
DeleteCriticalSection
GlobalAlloc
WriteFile
ReadFile
GetModuleHandleW
InterlockedDecrement
TerminateThread
CreateProcessW
GlobalUnlock

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ