16fcb70ee60edc7b978e3a1221cb3384_JaffaCakes118 | Triage

Sharing

General

Target

16fcb70ee60edc7b978e3a1221cb3384_JaffaCakes118
Size

28KB
MD5

16fcb70ee60edc7b978e3a1221cb3384
SHA1

e82642428575690cedde04b68c60886e1ee23bcc
SHA256

ea15ee7b4351860f9e5fefd6a567a6fd79630198e39e5f7d1882effae12874f3
SHA512

7d5dd195c235942807379808d60fab6c734350fb09e5294ff4a76e4decac635a6c7948d11d8146dd9b386409ded2827d58d03f9ee812e8de5217017cd31bbab4
SSDEEP

768:8FVU38iOpfzu2EQyZwYeeAl1cGAaJ5N5D:aaMi2f62xyOYGcO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16fcb70ee60edc7b978e3a1221cb3384_JaffaCakes118

Files

16fcb70ee60edc7b978e3a1221cb3384_JaffaCakes118
.exe windows:1 windows x86 arch:x86

dc1c3237df6344d7d429b31268052112

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

SetSoftwareUpdateAdvertisementState
DllUnregisterServer
FaultInIEFeature
IsValidURL
Extract

shell32

DoEnvironmentSubstW
DuplicateIcon
RealShellExecuteW
Options_RunDLLW
Control_RunDLLA
SHFileOperationA

Sections

.text
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE