167ca130e3a862dfdec84edc4200b2d0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

167ca130e3a862dfdec84edc4200b2d0_JaffaCakes118
Size

107KB
MD5

167ca130e3a862dfdec84edc4200b2d0
SHA1

3d64078a4e5e094137ea6bece839c34bff46072e
SHA256

44b0b76d8761466e2c9c7a4b853e14080fecaadf51fa5d974c6e9f2b259dde47
SHA512

c831584ef11cd5372e042a8686e86e2fca04811f9f1c9036c2ac28098455b901e588b1f3129f57e2e69bcdedf357fb00031805c6fc5888840953fce59836fb9d
SSDEEP

3072:T0Eumn6aC/U5zOr91IiNuzGaFPt7KFLtkpdD:nQawMGaFlKBtkpdD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
167ca130e3a862dfdec84edc4200b2d0_JaffaCakes118

Files

167ca130e3a862dfdec84edc4200b2d0_JaffaCakes118
.exe .ps1 windows:5 windows x86 arch:x86 polyglot

1c3a0a4449291f78848b720a6a2ab0c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
CreateEventA
GetVersionExA
CreateMutexA
CreateSemaphoreA
GetModuleHandleW
GetProcAddress
GetModuleHandleA
GetStartupInfoW

user32

LoadIconA
GetWindowDC
LoadCursorFromFileA
SetWindowTextA
ReleaseDC
LoadCursorA

shell32

SHSetLocalizedName

msi

ord212

msvcrt

_wcmdln
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_exit
_XcptFilter
exit
_initterm
__wgetmainargs
_onexit

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ