170a7ebfb711a80e276d1c54062cc0f6_JaffaCakes118 | Triage

Sharing

General

Target

170a7ebfb711a80e276d1c54062cc0f6_JaffaCakes118
Size

739KB
MD5

170a7ebfb711a80e276d1c54062cc0f6
SHA1

8ef9d30f2d6b70c9e031ae37735e5404a0847477
SHA256

115dc38d8063bf2c2beaff8faa339efe8e8cd036c9992f16fe6feba88e9a03af
SHA512

89e8c26eae684c2d1842f0768a3e0869966c694caab884fc935c47e4928982f8f13337b0a4be8d85a7838c7cc630123ae58fdfe914d9bd9cade1abfe07d871f3
SSDEEP

12288:gRM26JfcecwfvxuKh/Bl8/s3bh+bIQizs/gGS4/Ur98hUTulk/DKHiad:gRM9J0JIUKZ84N+0pzs/gXg+860k/DK5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
170a7ebfb711a80e276d1c54062cc0f6_JaffaCakes118

Files

170a7ebfb711a80e276d1c54062cc0f6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1d06044ce6455ac6b7f47d8f8d5731f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
EnterCriticalSection
CreateEventW
GetCurrentProcessId
EnumCalendarInfoA
GetModuleHandleA
GetConsoleAliasA
lstrlenW
LocalFree
FindClose
FindAtomA
GetDriveTypeW
GetNumberFormatA
GetPrivateProfileStringA
ReadFile
TlsGetValue
LocalFlags
HeapCreate
SetLastError
ResumeThread

user32

IsWindow
SetFocus
GetKeyboardType
GetKeyState
DrawTextA
GetCursorInfo
CallWindowProcW
DispatchMessageA
GetClassInfoA
GetClientRect
GetSysColor
GetMenuInfo
DispatchMessageA

stclient

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

ntshrui

IsPathSharedA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 729KB - Virtual size: 729KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ