2658f12229c8ffaa8b93524df0c09c14_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2658f12229c8ffaa8b93524df0c09c14_JaffaCakes118
Size

319KB
MD5

2658f12229c8ffaa8b93524df0c09c14
SHA1

c71386779abef6f51926c332d85c2e2a8abb1945
SHA256

9c39e5ff37249c67b3d761caa1f2aa6bf7405d002d7b08a9347e7df9c69630d0
SHA512

04f427cce2618437f73d86f51273510c410d5dc5c430a816d00e8be8594b7079f9b8730b9f4ed2c094f9ffc15d33f9bac0dbc97b94574666d7b7b8d6d302b7fc
SSDEEP

6144:B/4K/IOpSSwDbNH55/PW2A/9vIX640XfKmQJDCRMgXevv6:ZIHTH55/PWF/9B4SbQQRMgXev

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2658f12229c8ffaa8b93524df0c09c14_JaffaCakes118

Files

2658f12229c8ffaa8b93524df0c09c14_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6dd099f94038702fea19812bbce41f87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetProcAddress
GetModuleHandleA
LoadLibraryA
LockResource
VirtualFree
LoadLibraryExW
FreeLibrary
CreateFileA
GetTempFileNameA
GetTempPathA
WriteFile
CloseHandle
GetTickCount
LoadResource
SizeofResource
FindResourceA
ExitProcess
MoveFileExW
MoveFileA
GetCommandLineW

user32

DefWindowProcA
BeginPaint
EndPaint
PostMessageA
PostQuitMessage
SetTimer
RegisterClassExA
LoadStringA
DispatchMessageA
TranslateMessage
GetMessageA
ShowWindow
CreateWindowExA
UpdateWindow

shell32

CommandLineToArgvW
SHGetFolderPathA

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ