1ac20a6e2ecebe6e329e50b5c4f36a5b_JaffaCakes118 | Triage

Sharing

General

Target

1ac20a6e2ecebe6e329e50b5c4f36a5b_JaffaCakes118
Size

133KB
MD5

1ac20a6e2ecebe6e329e50b5c4f36a5b
SHA1

0a80761c7027126a76cf6a151182dc4da2d3d163
SHA256

487a1bf96b32acc3af333c3fba2a43019967bd0d8f5006fcdf59a76314a5d4c1
SHA512

5ec79702ba0c9ec2beeaa902dea1678849cf1e029993a861d89ed6b7eaaf268177623d714071c52f6cb138345501d8ed6bfcb5b4ea1d6e60a85969ff6c0ff3cb
SSDEEP

3072:H7ek6jL2NrZCW4CDcdDsRyt8Z1rWGreP:b8jLUZCWeay+3WM4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ac20a6e2ecebe6e329e50b5c4f36a5b_JaffaCakes118

Files

1ac20a6e2ecebe6e329e50b5c4f36a5b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b7453e576c3126d5b90c1ea601f8663

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetTimer
KillTimer
CharNextA
CharUpperA
PeekMessageA
PostThreadMessageA
GetMessageA
LoadStringA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

kernel32

ClearCommError
GetExitCodeProcess
CreateProcessW
ClearCommError
QueryPerformanceCounter
CreateFileMappingA
EnumResourceNamesW
ReleaseMutex
CreateMutexA
ExitProcess
ExitProcess
GetStartupInfoA
MapViewOfFile

Sections

.text
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ