1bac775b0b468daa757671e22b1a0832_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1bac775b0b468daa757671e22b1a0832_JaffaCakes118
Size

157KB
MD5

1bac775b0b468daa757671e22b1a0832
SHA1

80f111bb3fa9e6dd3934db3235da6b6437df815e
SHA256

45d6ad7cc4f2e061d3ce8dfe0cdd9d7d1ee67521593fab0f92bb32a1d4014245
SHA512

196a79c10df127258fd945a7366560e5920be8e15ea05f3a02cfacf73dd12f63f5a14cf17e59df29c3944907e06e5702e7d18cbc0ff2531385c3cf5a488946d8
SSDEEP

3072:yUXXb0PA9Tu8glyA2DJMa01/EsdJFnsxdSbifeh+S:37ilyA2DJqRnCSbKeAS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bac775b0b468daa757671e22b1a0832_JaffaCakes118

Files

1bac775b0b468daa757671e22b1a0832_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3d80f270b2c429e89a67a605a051fd37

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControlsEx

user32

EnumDisplaySettingsW

advapi32

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

kernel32

ReplaceFileW
GetCurrentProcessId
InterlockedExchange
InterlockedCompareExchange
GetProcessId
GetCurrentThreadId
SetUnhandledExceptionFilter
QueryPerformanceCounter
IsDebuggerPresent
GetTickCount
EnumResourceTypesA
TerminateProcess
ExitProcess
GetSystemTimeAsFileTime
Sleep
UnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess

shell32

ShellExecuteW

clusapi

CloseCluster

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ