2916903419674b0b166d28ba1d612ec2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2916903419674b0b166d28ba1d612ec2_JaffaCakes118
Size

156KB
MD5

2916903419674b0b166d28ba1d612ec2
SHA1

9df71327cc169549f576285e503dece1020f8df3
SHA256

a375065ce0eb8be81f92163042f958641a5ec95a849f575fbb47f87b7bf93d12
SHA512

f03a6c6b030d6deb9e90de70b62732c1809226e417fb481486472e6f2e5ffc25938c0529ffbbb1b547d108a6c533cdf50481e24c59ded07f70c8b446bed27172
SSDEEP

3072:rBDdZlz5UIxAqRDOWgIIvwuqYx8fxTc3wH1VdUZootTBlt:rBDhVqqZgrpxyxw3E1TaHtnt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2916903419674b0b166d28ba1d612ec2_JaffaCakes118

Files

2916903419674b0b166d28ba1d612ec2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d4fa046cbf8eae7bbbf0efcfcd5270e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetStartupInfoW
LocalFree
lstrcpynW
FormatMessageW
GetModuleHandleW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
lstrcpyW
GlobalFree
SetLastError
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
LocalAlloc
LeaveCriticalSection
GlobalReAlloc
GlobalHandle
EnterCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedDecrement
CloseHandle
lstrcmpW
ReadFile
WriteFile
SetFilePointer
FlushFileBuffers
ExitProcess
RtlUnwind
GetSystemTimeAsFileTime
GetCommandLineA

shell32

ShellExecuteExW

shlwapi

SHDeleteKeyW
PathCombineW

oleaut32

VariantClear
DispInvoke
CreateErrorInfo
SetErrorInfo
SysFreeString
GetErrorInfo

Sections

.text
Size: 57KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 314B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ