18c7f9763860d492ff4a304b99b96795_JaffaCakes118 | Triage

Sharing

General

Target

18c7f9763860d492ff4a304b99b96795_JaffaCakes118
Size

775KB
MD5

18c7f9763860d492ff4a304b99b96795
SHA1

92abfdfdae337d98fd961a9df8a472e81c35bc6b
SHA256

ff4a10125be61da9064b38bcf4083284a371f113a91ba0bd7c0821e7b482b2c7
SHA512

972ad2c16d48d272c088473ba804d2d487b2cb33ef9968a8d74b14b7a59f68f429e748048f50fb425b00114d2a241bd3b51308ba16405a9d31536eee9c420b06
SSDEEP

12288:oT+C9dxMYPkQ0XvvTgbwiFNXtpQWjWJ4b6qsh3aX4lqJSshD0y0eJfdeQfW+:oTf97Mu0HQXQwu4WnhaXoqJ34y0e7jfp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18c7f9763860d492ff4a304b99b96795_JaffaCakes118

Files

18c7f9763860d492ff4a304b99b96795_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1f32d9edbe6982f46177e2f4e83c0159

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
TlsGetValue
CloseHandle
GetCurrentThreadId
GetModuleHandleA
GetStdHandle
GetEnvironmentVariableA
GetProcessHeap
CreateFileW
SetLastError
GlobalUnlock
GlobalFree
lstrcpyA
HeapCreate
CreateProcessA
lstrlenA
LoadLibraryExW
ReleaseMutex
UnmapViewOfFile
FindResourceW

user32

DrawEdge
CreateIcon
GetDC
CreateWindowExA
DispatchMessageA
SetFocus
DrawMenuBar
IsWindow
CallWindowProcA
FillRect
GetCaretPos
CheckRadioButton
GetDlgItem

rsaenh

CPDeriveKey
CPGenKey
CPHashData
CPSignHash
CPDecrypt

msasn1

ASN1BERDecEoid

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 765KB - Virtual size: 768KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE