2741ec7fe1ced6f00446d43a87dd7fd7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2741ec7fe1ced6f00446d43a87dd7fd7_JaffaCakes118
Size

198KB
MD5

2741ec7fe1ced6f00446d43a87dd7fd7
SHA1

5f61d7a4149e66baa6b60538233c53ca4e214d1d
SHA256

5f9ec9bcd01b1008ced76aca324660e76e4baeba2457f58561a332e463931849
SHA512

1b6e63131bdd5f588973608a69eb0ee00a884c25a4e77e5cf6724e059de61886dc86acba66b0b1aa6ab0518e6fe118953d82215817c1e6ee91d9f3a5b60cf9c3
SSDEEP

3072:Pl24IhiJpUDtsHP35E23Gx59oJg+B15xsG4Hl/LUZUFm:uuy23G6ZxsG4l/LEG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2741ec7fe1ced6f00446d43a87dd7fd7_JaffaCakes118

Files

2741ec7fe1ced6f00446d43a87dd7fd7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

471174f77c5a8bfc15466810acbde6ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
SetLastError
DeleteFileA
GetOEMCP
GlobalFindAtomA
lstrlenW
GetCommandLineW
GetCurrentProcessId
GetDriveTypeA
IsDebuggerPresent
GetACP
lstrcmpA
GetThreadLocale
lstrlenA
GetCurrentThread
MulDiv
CopyFileA
GetUserDefaultLangID
Sleep
GetCurrentThreadId
GetWindowsDirectoryA
RemoveDirectoryA
GetLastError
GlobalFindAtomW
DeleteFileW
lstrcmpiW
GetProcessHeap
GetVersion
GetModuleHandleW
QueryPerformanceCounter
VirtualAlloc
LoadLibraryW
GetModuleHandleA
SetCurrentDirectoryA
GetTickCount
lstrcmpiA
GetCommandLineA
GetConsoleOutputCP

user32

GetDesktopWindow
GetDC
CharNextA
GetSystemMetrics

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ