0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118 | Triage

Sharing

General

Target

0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118
Size

164KB
MD5

0df3318d819d9ad6ebd2a967f1e98813
SHA1

5072f8aed37a42d820ba58472dfc48ba02dad908
SHA256

286c8d67eac594e9b15b554607c9c8a9a3c72cc99c0d7a62e15b74c9ec5a3253
SHA512

2a1366573abcea264470ef34a1c38319db5d65d9260943751943571bd18ba84fc6768d9453b37be8aed843039ff5fff8f365b7fa9fe425d45051207668e3a501
SSDEEP

3072:h8JoE0ABLF7U9/IjKZcg3T4pxyLaQFiAXCgRdAesXGDQghH/cE:UiWFGcg6AiIRuBXAf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118

Files

0df3318d819d9ad6ebd2a967f1e98813_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6a575cffd8defcc7af8585c594aa7c82

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
VirtualAlloc
SetUnhandledExceptionFilter
GetStringTypeW
LCMapStringA
GetACP
LCMapStringW
GetOEMCP
EnumResourceTypesW
GetStringTypeA
GetCurrentProcess
LZCopy
RtlUnwind
GetCPInfo
WriteFile
IsDebuggerPresent
LoadLibraryA
InterlockedExchange
GetLocaleInfoA

msimg32

TransparentBlt

oleacc

GetOleaccVersionInfo
AccessibleObjectFromEvent

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ