0e1799a7f4abd87159bcd39b5fa4829a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e1799a7f4abd87159bcd39b5fa4829a_JaffaCakes118
Size

120KB
MD5

0e1799a7f4abd87159bcd39b5fa4829a
SHA1

368b6e98faafd0e955b8a742ae73e0a4da3f4183
SHA256

3675bc3fae9ea93f71fe9ecc1f0539040ca5b7f036f8548b52b6acc2a013c032
SHA512

1948e6a43f3f99b3f3f0ff840f4187da878155801e6d8e06991a024d8ed9730404d218a76c199b60e7c32eb44a5137a9c2c3b1637d20749b54cb67b05a06e984
SSDEEP

1536:H3s66X/t3B8S95q3hEND15XhzMA5VhCprMHpAUikhvuodgw1:Xs66P1GG5GK13XhzMEDCRWzDhV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e1799a7f4abd87159bcd39b5fa4829a_JaffaCakes118

Files

0e1799a7f4abd87159bcd39b5fa4829a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37f86b872feee1f7ef70091edcc555de

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
ExitThread
ExitProcess
GetFileAttributesA
GetLocalTime
GetVersionExA
GetModuleHandleA
GetCurrentThread
CompareStringA
GetThreadLocale
GetProcAddress
GetFullPathNameA
GlobalDeleteAtom
VirtualAllocEx
SetLastError
ResetEvent
LoadLibraryA
GetCommandLineA
GetFileType

version

VerQueryValueA
GetFileVersionInfoA

shell32

DragQueryFileA
Shell_NotifyIconA
SHGetFolderPathA

gdi32

GetPaletteEntries
CreateBitmap
SetPixel
SetBkColor
SetTextColor
CreateDIBSection

advapi32

RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA

Sections

CODE
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ