0f8c1d8d54be59b868f70e8392290000_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f8c1d8d54be59b868f70e8392290000_JaffaCakes118
Size

94KB
MD5

0f8c1d8d54be59b868f70e8392290000
SHA1

20cb5424d432e2d51c7c48b9bd8a1615aa649c30
SHA256

be3a6aa5b04867e30ecf6deebbc644a8f60f24642154e030d50f85baa7dd5fed
SHA512

9876c4d22163333955b02510ac79746ddbe286ce65139e8ad8fffbade8839d1857f2d223591a3a337fe70195d747ea8921293f91af3811754cb8f3860caeb2c7
SSDEEP

1536:6/pPqbT/37rfgB/sE2fqrXA/M5in8AYwEqh9cfqlevJ4JWuNAHMowLah9/YPmNhe:spPqP/37rfgZsE2SjA/MQn3h4qA2jNOg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f8c1d8d54be59b868f70e8392290000_JaffaCakes118

Files

0f8c1d8d54be59b868f70e8392290000_JaffaCakes118
.exe windows:5 windows x86 arch:x86

06f8b0204b1b95ae011e9feb66da8d8d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenFile
VirtualProtect
InitAtomTable
IsBadCodePtr
IsValidLocale
ReadFile
SetConsoleCP
GetModuleHandleW

gdi32

GetMapMode
GetMiterLimit
GetPixel
CreateCompatibleDC
CreatePalette
GetBkColor
GetBrushOrgEx
GetCharWidthW
GetClipBox
GdiFlush
GetDeviceCaps
GetFontData
EqualRgn
EndDoc
Escape
FillPath
FillRgn
GetRelAbs
SetBkColor
GetTextFaceW

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE