2ed4c67467c61d8fa989b2e679f05039_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2ed4c67467c61d8fa989b2e679f05039_JaffaCakes118
Size

163KB
MD5

2ed4c67467c61d8fa989b2e679f05039
SHA1

da8e2cd09746cd659cd6ad10bb957919ca83e15c
SHA256

c48b14ad1799e1e91ad8a09deeda315e61a7561ecc531d8fa3e08ddc32793189
SHA512

48443b5eb3edd281fea001b5a760fad6ee2c645c7d5e900b979bec9ed5f4bfa8e6bcbc8d4077b34147bbc92e5dec9fcc7ac0ea35707ff3645c43d3f445bc4d4d
SSDEEP

3072:QAeYZ56yxrJ82rKUEBFZzK08Rwi7oRyMvnFtNrT1EBkKrKdS4b2ywwzAQ76cH1:QcGmFWUETZzKv57CnFtNnG6Kmp6pAAQP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ed4c67467c61d8fa989b2e679f05039_JaffaCakes118

Files

2ed4c67467c61d8fa989b2e679f05039_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d0428affb5a34dc8bb398555e7302481

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

winspool.drv

DocumentPropertiesW

kernel32

lstrcpynW
TlsSetValue
CheckRemoteDebuggerPresent
GetStartupInfoA
EnumResourceTypesW
InitializeCriticalSection
TlsAlloc
TlsFree
TlsGetValue
GetFileType

user32

MessageBoxW
GetDC
RegisterClassExW
GetAncestor
GetWindowInfo
CreateWindowExW
LoadCursorW
EndDialog

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.apexi
Size: 1024B - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ