0ddc7b63e980db8b7140e0d3b3c69d43_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ddc7b63e980db8b7140e0d3b3c69d43_JaffaCakes118
Size

326KB
MD5

0ddc7b63e980db8b7140e0d3b3c69d43
SHA1

3b2e0a9abf3e9cc324f79ad3fac3a379a3dc2f2f
SHA256

4f3fac4e98503917430b1db4afda6c3e2a0fe5376fc0afed2d3f9b3d27029b11
SHA512

3102c0f06ddda2f4c4db70e5e7ac66ea67be6206b4548834f96d8057bd1dd4522132b76ded8e117289a7b8aae1ffbadc21fa23ddd37f008e49896e827515bc74
SSDEEP

6144:RqwD+X1xQatU+1CEJp4XEt8l3aw9Y6zfJvkeitTDYWMtrDVmCfNuI2RINhoDPnr:nO1xm+QoK0t4K3gCTDYWGrYzt+NST

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ddc7b63e980db8b7140e0d3b3c69d43_JaffaCakes118

Files

0ddc7b63e980db8b7140e0d3b3c69d43_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1dc67f4cde3a9bca49d2848e08378d43

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
CreateThread
CreateFileA
GetModuleHandleA
LocalUnlock
GetComputerNameA
CloseHandle
LoadLibraryW
GetCommandLineW
GetDiskFreeSpaceA
lstrlenA
GetSystemTime
Sleep
GetTickCount
UnmapViewOfFile
LocalFree
ResetEvent
GetDateFormatA
HeapCreate
FindVolumeClose

user32

DrawMenuBar
GetComboBoxInfo
CreateWindowExA
DrawStateA
GetDlgItem
SetFocus
GetDC
IsWindow
CallWindowProcA
DispatchMessageA
FillRect
CheckRadioButton
DrawEdge

advapi32

FreeSid
RegCloseKey
RegDeleteKeyA
RegEnumValueA
IsTokenUntrusted

sysdm.cpl

NoExecuteAddFileOptOutList

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 732KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ