0f4757f00486a317c07586a5f7590e64_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f4757f00486a317c07586a5f7590e64_JaffaCakes118
Size

177KB
MD5

0f4757f00486a317c07586a5f7590e64
SHA1

b08a2ad208fa260a311fd922e92c8eb42a0406a5
SHA256

079a1bb8c98743ec8af97c547279c4bfa5b374099973798df88a2eff7a107dba
SHA512

cd7126613949de3f9450fec7e86e0cfb6a2d1c0a505012f56238212f475ffe712e239f5a111c210868a6853fafe8be31cf0faa2d88bc432f311283c041aa2381
SSDEEP

3072:JS08L2GsbNyYMUC8y89J7bmiGkQj7NWcaYG6Q3Jvmor3eil+UT6vtscZ0xlz1:JE5sbxMUTy879GkUgTYjQ3Jvj1lveW2k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f4757f00486a317c07586a5f7590e64_JaffaCakes118

Files

0f4757f00486a317c07586a5f7590e64_JaffaCakes118
.exe windows:4 windows x86 arch:x86

881cb16b751b67c5b25e9a9a3c369e4f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

winspool.drv

DocumentPropertiesW

user32

CharNextW
PostThreadMessageW
DispatchMessageW
TranslateMessage
CharUpperW
SetTimer
GetDC
GetAncestor
GetMessageW
KillTimer
wsprintfW
UnregisterClassA

kernel32

MultiByteToWideChar
FindClose
lstrcpynW
GetCPInfo
CheckRemoteDebuggerPresent
WideCharToMultiByte
lstrlenW
GetACP
GlobalAlloc
EnumResourceTypesW
lstrcpyA
GlobalFree
OutputDebugStringW
DeleteCriticalSection
InitializeCriticalSection
lstrcpyW
LockResource
lstrcmpiW
GetLastError
GetTickCount
GetModuleHandleW

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isete
Size: 1024B - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ