2ddbed0ab43ab50a5f3984980ba8c31c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ddbed0ab43ab50a5f3984980ba8c31c_JaffaCakes118
Size

175KB
MD5

2ddbed0ab43ab50a5f3984980ba8c31c
SHA1

c365cb2a6e6c08049b6b79407326addb535adc5c
SHA256

4e99ce015eface216b6e385558454d717b795a90efbdd0063060200d07ea18a5
SHA512

985f8932bbd06653411c5f542e0626008cdacbf2fe7198eb8c1fb495869df0e138cf2a73bab07f2f390d0c845588dae761c2bcb7c3d2fbc3488c7dfb3c2db854
SSDEEP

3072:AlkgkiwHuziFHm+HCFE4xb2Qbrz+MSxdLNdKAZz/u13odwsliU8pdmID:AyDiwzziFE47cLNAYy3odwmX8pdb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ddbed0ab43ab50a5f3984980ba8c31c_JaffaCakes118

Files

2ddbed0ab43ab50a5f3984980ba8c31c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

137a9b4a6059d8b53e3c9d8dbb713fc9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

K:\oLolIJoxaKHM\iwzdekfpUkMwd\nlzdccaV\kfiocfmAgquGev.pdb

Imports

gdi32

CreateRectRgn
GetRgnBox

kernel32

CreateFileMappingW
GlobalMemoryStatusEx
GetModuleFileNameW
GetComputerNameA
EnumResourceNamesW
VirtualProtect
CloseHandle

user32

SetWindowTextW
MonitorFromPoint
DefWindowProcA
GetUpdateRgn
TranslateAcceleratorA
SetMenuDefaultItem
TrackPopupMenuEx
WaitForInputIdle
SetFocus
AdjustWindowRect
EnableMenuItem
IsWindowEnabled
CopyRect
SetRectEmpty
FindWindowExA

ntdll

RtlCompareMemory

Exports

Exports

?TemporaryArrayCre

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hvb
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ek
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.hv
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ