16d89d6eb1650fb8b38f0ed60e43a326_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16d89d6eb1650fb8b38f0ed60e43a326_JaffaCakes118
Size

836KB
MD5

16d89d6eb1650fb8b38f0ed60e43a326
SHA1

6fb633f396507ee1cf87b655beee2093b18926a4
SHA256

d8c2d1fe2aacbf14e09b3337abb873931fc20f70f461f88bf65dea34a7895670
SHA512

4f1d1297dafc29eed6cfee1c4cffe32e8f3703dea17bb8f77b35d054dc14286ceeb83ca675e921adf1ddd22edccfe4d314171bf224fc4d11637a7361c7adb295
SSDEEP

12288:8NQnBGINmkfoe2EmUs/AsQLdnA9AnDdq453sfYIW04eerfoVcf2BQTqGjygxc:8NQnMus/SJAGnJbevergKf2r7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16d89d6eb1650fb8b38f0ed60e43a326_JaffaCakes118

Files

16d89d6eb1650fb8b38f0ed60e43a326_JaffaCakes118
.exe windows:4 windows x86 arch:x86

211a6894773bd27790c296566d49ba63

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

ShowWindow
RemoveMenu
UnregisterClassA
GetDlgItem

kernel32

GetACP
TerminateProcess
Sleep
GetOEMCP
SetStdHandle
GetModuleHandleA
SetConsoleCP
GetStdHandle
GetStartupInfoA
ExitProcess
HeapAlloc
GetSystemTimeAsFileTime
TlsFree
GetCommandLineA
HeapSize
HeapCreate
TlsSetValue
LCMapStringA
GetProcAddress
VirtualProtect
GetVersion
LoadLibraryExA

ole32

StringFromGUID2

gdi32

GetDeviceCaps

msvcrt

_initterm
?terminate@@YAXXZ
memmove

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 600KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ