259e3baf84e6fd05cc4ab4800c4b1875_JaffaCakes118 | Triage

Sharing

General

Target

259e3baf84e6fd05cc4ab4800c4b1875_JaffaCakes118
Size

88KB
MD5

259e3baf84e6fd05cc4ab4800c4b1875
SHA1

d7fbe81cde399727e9054bf6b6b06b44f8b69ce2
SHA256

8516835a6584b5cb6486c4ebcaf1a80f922d39df9ae083921e82fd5dcfdfe23a
SHA512

e9a556a4389262a1109973387d578ea5ec2e3ec372ff683bf3a89047d29f5f2ffe8b149607163e9e9f58b6b959d9a7b1649105de3e7e4591ffb405820e91f8ea
SSDEEP

1536:+OUjCCdVuUB24Ngwy6SogaaQg2Dz+EcMexSivkKRJ:hSCCuS24NfyogaaQdDztpGSmr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
259e3baf84e6fd05cc4ab4800c4b1875_JaffaCakes118

Files

259e3baf84e6fd05cc4ab4800c4b1875_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3a01c160c5740731d2233d66881a716c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetDiskFreeSpaceExW
IsBadCodePtr
CloseHandle
IsBadReadPtr
PulseEvent
GetDateFormatA
FindClose
GetLastError
Sleep
SetLastError
VirtualProtect
LoadLibraryExA
EnumResourceTypesA
TlsGetValue
GetCommandLineA
FreeConsole
DeleteCriticalSection
LocalFree
GetDriveTypeW

shell32

ShellMessageBoxA
DllUnregisterServer
DragQueryFileA
ShellAboutA
DragAcceptFiles
ExtractIconA
SHGetMalloc
SHGetSettings
DuplicateIcon
SHGetDiskFreeSpaceA
StrChrA
DragFinish
SHFree

msasn1

ASN1BERDecBool
ASN1BERDecEoid
ASN1BERDecDouble
ASN1BERDecCheck
ASN1BERDecFlush

advapi32

RegCloseKey

Sections

.text
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ