26875e3366140154d53bdd94b9fe16e7_JaffaCakes118 | Triage

Sharing

General

Target

26875e3366140154d53bdd94b9fe16e7_JaffaCakes118
Size

69KB
MD5

26875e3366140154d53bdd94b9fe16e7
SHA1

ceebfe50e28acfee9b1c437d24cab00b755e8397
SHA256

d5c2cef32dbf875d9241ad6574d880cb93223458d0aa0048c0b0ce8c531e9d70
SHA512

cc66e86a72a4d855d72243632e194832266160b9052097c78c2ef9cecfb0ac038673c93b640550ccbdfcb37caca26561d90b37099377654eacc12ba80dc3a5a9
SSDEEP

1536:LL3WULO6nIai9F4Sxf/yC2TIHGCHCzbYOcU3qlTxoqShT:LTbVnIaeFj/y1kGCizbYO33qFxoqSN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26875e3366140154d53bdd94b9fe16e7_JaffaCakes118

Files

26875e3366140154d53bdd94b9fe16e7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc60a920495dd603b6329f9f82fb28de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Acro_root_apms\build\Release-results\info\template.pdb

Imports

kernel32

GetModuleFileNameW
GetProcAddress
LoadLibraryW
HeapFree
GetFileAttributesW
HeapAlloc
GetProcessHeap
GetCommandLineW
SetStdHandle
ExitProcess
CreateFileW
GetModuleHandleW

shell32

CommandLineToArgvW

msi

ord173
ord205

user32

MessageBoxW

shlwapi

AssocQueryStringW
StrCmpW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE