0d71550ba6e5284011e42b5e699c9614_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0d71550ba6e5284011e42b5e699c9614_JaffaCakes118
Size

171KB
MD5

0d71550ba6e5284011e42b5e699c9614
SHA1

6f53dd45a1e9fed7bd614c1382c5cb9819955dad
SHA256

687d633a7b845e943933c0d016881a852e54dfd21334c18c1de0ace5d7c37d8d
SHA512

5bbf5661aa28ce32b8e902933b9c48314dca1bfbe437a5602bfe5596862ab31f27d6338767895d3942bcacea07bf87eed506233e34a2c8f94f77b43c59c5392e
SSDEEP

3072:ySi7WzVOQzR6QryTzv4VJTN0HO96KwMA6ZAVk4T640efCsEuyGACdz/ii8Q:JFUQzRRu5k6WASZ4T640efsp7kP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d71550ba6e5284011e42b5e699c9614_JaffaCakes118

Files

0d71550ba6e5284011e42b5e699c9614_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ca514bfb66cdd5260bd729cd7f7fecad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

P:\oIQnqAds\qMpWZZlCaEoMc\RrbwvyFa\cbuawVach\yFhzfGnknzDJs.pdb

Imports

kernel32

GetLocaleInfoW
ResumeThread
GlobalFree
FreeResource
QueryDosDeviceW
GetComputerNameExW
MulDiv

shlwapi

PathUnmakeSystemFolderA

advapi32

RegQueryValueExA
RegQueryValueExW
RegReplaceKeyA

user32

ShowCursor
SetCursorPos
GetTopWindow
IsWindow
GetClientRect
IsWindowUnicode
GetFocus
OffsetRect
MessageBeep

ntdll

RtlCompareMemory

Exports

Exports

?InsertFil

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fxc
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fx
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ