2dc2dd6d53704ea1a9a15c21a5b1eee6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2dc2dd6d53704ea1a9a15c21a5b1eee6_JaffaCakes118
Size

232KB
MD5

2dc2dd6d53704ea1a9a15c21a5b1eee6
SHA1

b9efce7ea5d6d51a24b0ab1eb758c654087dd10b
SHA256

879a63684931c7d9165364cf91076315624055fec0963ea719b3e73bb1ce1774
SHA512

d9a9fed37cd578a2215352fc6179155526884a3bd4660f7ab9bf64cf3837e2a0c5a9fb418dab205440a144c50d78bfcd271816c12f2b0e3bb3c31d6fad70d982
SSDEEP

1536:jYAtPIhGYFz/SkR5e0Rg+m6rbI8UnpwIN7M/KdW:jd1+z6kR5E+mpTdW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2dc2dd6d53704ea1a9a15c21a5b1eee6_JaffaCakes118

Files

2dc2dd6d53704ea1a9a15c21a5b1eee6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7d9157c2156b1dce9a225c37b78c9f3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtGetContextThread
NtSetContextThread
NtResumeThread
NtWriteVirtualMemory
NtUnmapViewOfSection
NtAllocateVirtualMemory

urlmon

URLDownloadToFileW

shell32

ShellExecuteW

user32

CallWindowProcW
FindWindowW
PostMessageW

kernel32

GetFileAttributesW
DeleteFileW
CreateProcessW
GetModuleFileNameW
GetSystemDirectoryW
CopyFileW
Sleep
SetFileAttributesW
CreateDirectoryW
GetEnvironmentVariableW

msvbvm60

ord582
ord583
ord584
ord516
ord660
ord593
ord520
ord631
ord632
ord525
ord526
DllFunctionCall
__vbaExceptHandler
ord608
ProcCallEngine
ord644
ord537
ord573
ord575
ord100
ord546
ord581

Sections

.text
Size: 224KB - Virtual size: 223KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ