148f9f15631867de00eb5f4e776d8b15_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

148f9f15631867de00eb5f4e776d8b15_JaffaCakes118
Size

171KB
MD5

148f9f15631867de00eb5f4e776d8b15
SHA1

a871cd2228e7c41d174d3851733be8bcdb1c5782
SHA256

8df12a97ef714280a3f6f18b1cc5d29e0d7ec740e7e8384fed61462e94787c0d
SHA512

a6d41687935a8367b034c1878a0cae248194e02d2ca1082c67f8214b07f5590e3a2d2f920f72adb8308325160008df95844cfcbae2d15c1ac13c9835b86e89bc
SSDEEP

3072:Tc8REjQzS5q2EcIXwx7UyB2vjxm26YBM40Pg3VylJkBs/MdCz7m0CBQ:6jQM/IQ5B27xHVwQVyPkBNQQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
148f9f15631867de00eb5f4e776d8b15_JaffaCakes118

Files

148f9f15631867de00eb5f4e776d8b15_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ee8f15a8ca24548ea050ada5d8bb9cd9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

V:\vbRgeUPlq\rjNDfqvRMl\iUcjRIzpJn\zpLnQWM\bcNSqakeSlmDy.pdb

Imports

kernel32

GetModuleFileNameW
GetComputerNameExW
SearchPathW
WaitForSingleObjectEx
IsValidLocale
GetCurrentThread
GetFullPathNameW

shlwapi

PathUnmakeSystemFolderA

advapi32

RegQueryValueExA
RegQueryValueExW
RegReplaceKeyA

user32

GetTopWindow
KillTimer
ShowCursor
IsWindow
GetClientRect
OffsetRect
SetCursorPos
GetActiveWindow
MessageBeep
GetFocus

ntdll

RtlCompareMemory

Exports

Exports

?ValidateDataInFile@@YGKXZ

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pack1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ