2b9068bf3761aa7f4e9e021aa9ca2c6a_JaffaCakes118 | Triage

Sharing

General

Target

2b9068bf3761aa7f4e9e021aa9ca2c6a_JaffaCakes118
Size

167KB
MD5

2b9068bf3761aa7f4e9e021aa9ca2c6a
SHA1

c22e41400e341257c688a8fed32a1c28082d3880
SHA256

d5e7a2f62c84a3f2c759732366e60499a2a6ec180840b5a70e18a31d43780f21
SHA512

3b251e4bdf5dcddb80d27978ea33a62b975ccdbd3499bd1d47b3f95e41989775ea6fe3a6cb8eb454a8d8711eb8f1e4011f8bf2a310e68087eeac7c8344206108
SSDEEP

3072:wPWkDDCakNsy6pClryMQLisXm4mzgFmWlrvTofyI6eOop85Ifi3n:cWADCPvlryv64mSmW6yI6eOoq5UOn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b9068bf3761aa7f4e9e021aa9ca2c6a_JaffaCakes118

Files

2b9068bf3761aa7f4e9e021aa9ca2c6a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

43e5b238c5ae9f0395e86159ec7ecd08

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
AddAtomA
GetModuleHandleA
GetProcAddress
GetProcessHeap
TlsAlloc
EnumResourceLanguagesW
HeapAlloc
GetVersionExA
GetPrivateProfileStructW
HeapFree
TlsGetValue
ExitProcess
TlsSetValue
TlsFree

setupapi

CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

comctl32

ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter

iphlpapi

GetIpAddrTable

shlwapi

StrCmpNIA
StrStrA

shell32

SHGetFolderPathW

newdev

UpdateDriverForPlugAndPlayDevicesW

Sections

.text
Size: 136KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ