2a0286e797d323afd852baf8c02056b1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a0286e797d323afd852baf8c02056b1_JaffaCakes118
Size

323KB
MD5

2a0286e797d323afd852baf8c02056b1
SHA1

6464f6a41ca201a53db6025847900965013d6a0c
SHA256

f489a26b2c6f7e38a82cace1926e936ecbce540fc80eeffc241cc7a86debe0df
SHA512

0c591dce1cdf6993b1435bf250427a5f5109fd661fd41b8f29e89fe91f47d9c586e834ac31bd4913dfc82783c5cc1cd19558f6deb73914212df5ef0e0affee33
SSDEEP

6144:kZE+9zxIAXDOx12H6pNkbNRJWr6PKRUKcs2tXv+vu0:w9zzTOxy6HkB74cv85

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a0286e797d323afd852baf8c02056b1_JaffaCakes118

Files

2a0286e797d323afd852baf8c02056b1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6dd099f94038702fea19812bbce41f87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetProcAddress
GetModuleHandleA
LoadLibraryA
LockResource
VirtualFree
LoadLibraryExW
FreeLibrary
CreateFileA
GetTempFileNameA
GetTempPathA
WriteFile
CloseHandle
GetTickCount
LoadResource
SizeofResource
FindResourceA
ExitProcess
MoveFileExW
MoveFileA
GetCommandLineW

user32

DefWindowProcA
BeginPaint
EndPaint
PostMessageA
PostQuitMessage
SetTimer
RegisterClassExA
LoadStringA
DispatchMessageA
TranslateMessage
GetMessageA
ShowWindow
CreateWindowExA
UpdateWindow

shell32

CommandLineToArgvW
SHGetFolderPathA

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ