215e7e05c14052c3f0de978f5f8712c8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

215e7e05c14052c3f0de978f5f8712c8_JaffaCakes118
Size

84KB
MD5

215e7e05c14052c3f0de978f5f8712c8
SHA1

f1ace9eeaf195c13098d95e709465a79dcadbaa7
SHA256

fffd5b8b933e5171a1054395c04fd8660e9c938dd8ec0eacc7d0e0ae1fe7da04
SHA512

dff138f7d9ad262243510f12002da166008a8025d5ad8019bad1cda3a63b19afa1e5c486c7487b78fef5055f9a441e935f1676ddcf8172ff5e5b4ef3c4168d89
SSDEEP

1536:UDzY8t/jP6hQ/ys0WGfCP3N+MJLca0+2NqbZCVBfGGsywLP:UDFt/jr0WpfN31cr/4bZCfGGDK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
215e7e05c14052c3f0de978f5f8712c8_JaffaCakes118

Files

215e7e05c14052c3f0de978f5f8712c8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b667ee07c0dc668ad0aef139f10e57c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetModuleHandleA
LockResource
VirtualFree
LoadLibraryA
LoadLibraryExW
GetProcAddress
FreeLibrary
CreateFileA
GetTempFileNameA
GetTempPathA
WriteFile
CloseHandle
GetTickCount
LoadResource
SizeofResource
FindResourceA
ExitProcess
MoveFileExW
WinExec
GetCommandLineW

user32

DefWindowProcA
BeginPaint
EndPaint
PostMessageA
PostQuitMessage
SetTimer
RegisterClassExA
LoadStringA
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
CreateWindowExA
ShowWindow

shell32

CommandLineToArgvW
SHGetFolderPathA

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ