245931588f1218f9cd72ee489836983a_JaffaCakes118 | Triage

Sharing

General

Target

245931588f1218f9cd72ee489836983a_JaffaCakes118
Size

172KB
MD5

245931588f1218f9cd72ee489836983a
SHA1

a3b3aa0c51b11e219ad2771fe9dbcef3744c2941
SHA256

52fbbabb0dedb072dcce16af639827de6a377d3fd48df571be9528fb294f3786
SHA512

d10c5640b6aaabccc92577cc6ecb1c4247d7167ba429e0a04cc44356ff56289775c9dec65724e294292283a64832cd409797f42502e6eabbf18a56a4d06ef201
SSDEEP

3072:58sHCMzHUdKuYtiywECUdB3m/MpgJObYcUQNyPJ1bI2o+gpg8iyVIiwlh/n:RCM0c/EUdB3megd0Y1k2opuGEhf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
245931588f1218f9cd72ee489836983a_JaffaCakes118

Files

245931588f1218f9cd72ee489836983a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b609915c24417d795bd4d4a692327ea0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
GetCurrentThreadId
lstrcmpiA
GetUserDefaultLCID
WriteProcessMemory
SetFileTime
OpenSemaphoreA
_llseek
CreateMailslotW
VirtualAllocEx
GetConsoleTitleA
LoadLibraryExA
GetPrivateProfileStructA

user32

TileWindows
TabbedTextOutA
AdjustWindowRectEx
GetMenuItemInfoA
GetNextDlgGroupItem
DialogBoxIndirectParamA
CharToOemBuffW
SetMenuContextHelpId

gdi32

CreateFontA
GetMetaRgn
PolyBezierTo
GetBrushOrgEx
ScaleWindowExtEx
PatBlt

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 850B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE