298b597c3932c359404271c487877702_JaffaCakes118 | Triage

Sharing

General

Target

298b597c3932c359404271c487877702_JaffaCakes118
Size

276KB
MD5

298b597c3932c359404271c487877702
SHA1

7f8c3b822da57221e5c5981ab61c58c9250a2300
SHA256

f6d29939dca14eb216872638a40488631a9b1b7c8ab9a6a399398ca95a3dc05b
SHA512

25d2a0bed16ea1943dbfdd67de24b9c149e6348237b6290bf13299fa294f273d73d8c2014fb3d8f597eba46ab8e919c62a038c6ebc5cd8ba533f619d7b7c08d4
SSDEEP

6144:xQGzScV//RGT71E0RVwzpjG1rHJFAon7uzgq94:CGScdRGv1E0Hwz1EAO7Zw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
298b597c3932c359404271c487877702_JaffaCakes118

Files

298b597c3932c359404271c487877702_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d4ac8e34b65ca2ea542256acc2a92f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalHandle
WideCharToMultiByte
AddLocalAlternateComputerNameA
GetCurrentProcessId
lstrlenA
FindNextFileA
FindFirstFileA
IsDBCSLeadByte
GetModuleHandleA
EnumResourceTypesW
EnumResourceLanguagesW
SetFilePointer
QueryPerformanceCounter
CreateMailslotA
GetCurrentThreadId
ReadFile
WriteFile
FindClose

newdev

UpdateDriverForPlugAndPlayDevicesA

oleacc

AccessibleChildren
CreateStdAccessibleProxyW

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ