0e79a4dc79b66f5ad7eaf63050a79fc7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e79a4dc79b66f5ad7eaf63050a79fc7_JaffaCakes118
Size

238KB
MD5

0e79a4dc79b66f5ad7eaf63050a79fc7
SHA1

0ab736449546fd0f58fd9a7da9ebc4c78a082b6e
SHA256

0d47dc9a05397a05e12bac34123ba53ad7db17aa433dde1fcb81b6f2c6c6c037
SHA512

817a66f3ff9106038ec8201255da70c6a6ae18286e74850edee94ef19e819b4848f688b224244935723a07780c44e681687b1fbe8985e469c403a4ad68d83da0
SSDEEP

3072:PGXKi8M3qCDFFkl1Z7QwpASBNLMVgjlfjm3AqfjVhfwW1+2atMKm7zb9fSxYivo/:+P8M3qCp03712VEazrYuaCvuYiEJJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e79a4dc79b66f5ad7eaf63050a79fc7_JaffaCakes118

Files

0e79a4dc79b66f5ad7eaf63050a79fc7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

48bca475f4a8154d94adb956a0a2daba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetUserDefaultLangID
GetModuleHandleA
VirtualProtect
GetConsoleAliasW
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcessHeap
GetModuleHandleW
CreateProcessA
GetTempFileNameA
HeapFree
HeapAlloc
LoadLibraryW
InterlockedExchange
Sleep
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLastError
GlobalFree
GlobalUnlock

oleaut32

DispGetIDsOfNames
DispGetIDsOfNames
SafeArraySetIID
CreateErrorInfo
SafeArrayAllocDescriptorEx
GetErrorInfo
SetErrorInfo
GetActiveObject
VariantInit
SysFreeString

oledlg

OleUIBusyA

Sections

.text
Size: 141KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE