1a4859c48aeb15b872106a28b7bf5c92_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1a4859c48aeb15b872106a28b7bf5c92_JaffaCakes118
Size

100KB
MD5

1a4859c48aeb15b872106a28b7bf5c92
SHA1

ae489648ecf6e6c1174071676e961aaa72790675
SHA256

1b51d3adf751eda23837a2f2b6f01fdf1b5477584897690c76f82d4d0f26e77e
SHA512

1f8a4c86802b9ea35225279f40264bb4b9c252495ad30e135d805d8ff01fd1d39833ceb678c37f153a20607debf2379a8de48d6f7dbc430496926ce3a0c0662c
SSDEEP

1536:kEJ8Blpm3tXmoZBc7d9vmhplDzg0YFYK8ceHCnNmxJltrMtw/Z4Ro7:ejY3tXmoZGd9OxXy8cGumxJPr8U4C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a4859c48aeb15b872106a28b7bf5c92_JaffaCakes118

Files

1a4859c48aeb15b872106a28b7bf5c92_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ac1956bcdda8414ae3b5d5fd0c44b0f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
IsBadReadPtr
GetCurrentProcess
DeleteFileA
GetWindowsDirectoryA
GetModuleHandleA
MultiByteToWideChar

ole32

CoUninitialize
OleSetContainedObject

user32

MessageBoxA
DefWindowProcA
CreateWindowExA
DestroyWindow
GetSystemMetrics
PostQuitMessage
LoadIconA
GetMessageA
UpdateWindow
TranslateMessage

advapi32

RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetMalloc

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 934B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ