180a49caa70acfc5863a21b4fe71fc32_JaffaCakes118 | Triage

Sharing

General

Target

180a49caa70acfc5863a21b4fe71fc32_JaffaCakes118
Size

8.9MB
MD5

180a49caa70acfc5863a21b4fe71fc32
SHA1

1efa4335e5e15f4feea2433d13ba87f7cba340d7
SHA256

ac634f17904420a1cf705a31bae80970e4a1668a651d6934289d29e77c0c6c30
SHA512

d7961d2deb46945341fbd906f93ed8926d2ee0efda4384608d2b6bba8a8395971bc8e20c69e4fae06ca815ab3949c6c2580be1d69e64154d3a5abe598cabc66f
SSDEEP

196608:IsJ/qG07tmU5OdDswpxNTm/mZugVEcwkzV4RGie9FhnCs3M+2s+:rRqG07tmSaDswpxNTZvjGkiwlM+2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
180a49caa70acfc5863a21b4fe71fc32_JaffaCakes118

Files

180a49caa70acfc5863a21b4fe71fc32_JaffaCakes118
.exe windows:4 windows x86 arch:x86

44305a9a8e1b96b1d2ccc5b9831d810e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetDoubleClickTime

shell32

ShellExecuteA
SHGetSpecialFolderPathA

shlwapi

StrChrIA
StrStrA

kernel32

lstrcpyA
lstrcatA
WriteFile
Sleep
SizeofResource
CloseHandle
CreateFileA
ExitProcess
FindResourceA
FreeLibrary
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTickCount
LoadLibraryA
LoadResource
LockResource
RtlZeroMemory

urlmon

IsValidURL
CoInternetCompareUrl

comctl32

GetMUILanguage

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE