28dc443aa8d372309de043f9609640b6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28dc443aa8d372309de043f9609640b6_JaffaCakes118
Size

355KB
MD5

28dc443aa8d372309de043f9609640b6
SHA1

4913de91317e2583ae1a49b1b4d64a078896c382
SHA256

ef772867faee804afb010c582f3f81c89e9b77a91c68ec226b9b0c773bbd2a76
SHA512

a4a41646b97f652d7cfbf3540f8d8d754f67003193fd050c94bcf3bf0b8a828b5d8d918e724dfb852c992835b632033ed795a0aa699f65efa64c00869106e1b9
SSDEEP

6144:XSGbHxSlGPQBaZ+BqhMXAy6fYv2SeJ3eB8fvmKNNcQ5ta6gKv5R3L/XWlpWzsVVT:CGbR9QI0Ay6fYvzEOe2KNSQ6l83zBzsb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28dc443aa8d372309de043f9609640b6_JaffaCakes118

Files

28dc443aa8d372309de043f9609640b6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37d3a2bfee5fa11197686c1286f02136

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
ResetEvent
GetFileAttributesA
lstrlenA
FindAtomW
GetSystemTime
GetTickCount
GetDiskFreeSpaceW
GetModuleHandleW
GetCommandLineW
CloseHandle
LoadLibraryA
LocalFree
SuspendThread
VirtualAlloc
GetComputerNameW
ResumeThread
GetPrivateProfileIntA
GetTickCount
ExitProcess

user32

DestroyCaret
CreateWindowExA
CloseWindow
GetMenu
DrawStateA
GetDlgItem
GetClassInfoA
DispatchMessageA
GetCaretPos
FillRect
EndDialog
CallWindowProcA
GetClientRect

rasapi32

RasDialA
DwCloneEntry
RasDeleteEntryA
DwEnumEntryDetails
DwRasUninitialize

adsnt

DllGetClassObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 440KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ