28323cf7aa3b132d3829b6cef171272a_JaffaCakes118 | Triage

Sharing

General

Target

28323cf7aa3b132d3829b6cef171272a_JaffaCakes118
Size

617KB
MD5

28323cf7aa3b132d3829b6cef171272a
SHA1

a7610a8fd0b6015e3ad069b3e4c36f2395d055f3
SHA256

eba1d4a85e4da3e7c801e509b1e707693ba16518af23308d58d60258a7533b1a
SHA512

d04194b0be10b7d24d6ac3af9bba5f68bd9d9962834f3e26979619b065d9f598ca79b42fd285d99177736133f3f20f3c505f3103bcfd27c4a746cacf5c589103
SSDEEP

768:o6aQLTdVtIVYLsW74sC6o9Pp4uSiKxjVWzGGDha+dFUY+R0FbB925ir/k5R5cNH6:3FTdcUsye5aWGCha+L8wbP2ir/k7/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28323cf7aa3b132d3829b6cef171272a_JaffaCakes118

Files

28323cf7aa3b132d3829b6cef171272a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4e5b87e72813aa3b7e41114fb9a626c5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

StrChrIA
StrStrA

kernel32

lstrlenA
lstrcpyA
lstrcatA
CloseHandle
CreateFileA
ExitProcess
FindResourceA
FreeLibrary
GetCurrentDirectoryA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTickCount
LoadLibraryA
LoadResource
LockResource
RtlZeroMemory
SizeofResource
Sleep
WriteFile

urlmon

IsValidURL

comctl32

GetMUILanguage

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 838B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 601KB - Virtual size: 601KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE