3016a0c1fead8267f18c0eab8fe68186_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3016a0c1fead8267f18c0eab8fe68186_JaffaCakes118
Size

327KB
MD5

3016a0c1fead8267f18c0eab8fe68186
SHA1

f58b1e946479feb3c9d26920e83ead587b7304f5
SHA256

ce459514cdf313ee25fce0a9a60437ed5eb12a35517b32020886fba8857b450a
SHA512

9dab9eb0a89a7e46ea44b1e461f793b7becb473c07f78151e018e0c7c1af63cb0601be1c1f1df7a2d8a6d365cb4050f289a5b5a8aff67dd39e98ebbb21dedb98
SSDEEP

6144:Vgn7S8/J5cHTLVgJVOVaVUbseAwKyz2tXCK5mZ5ieukIaJjZI:uZ/fcHlgrkUwsKKyqw8/aJj2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3016a0c1fead8267f18c0eab8fe68186_JaffaCakes118

Files

3016a0c1fead8267f18c0eab8fe68186_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1004cb69d2b694b49efc29796e8623fc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
IsBadReadPtr
LoadLibraryExW
SetLastError
CancelIo
CloseHandle
TlsGetValue
LocalFree
GetModuleHandleA
lstrlenA
IsBadStringPtrA
FreeConsole
EnumResourceTypesW
GetConsoleTitleA
Heap32First
ResetEvent
GetLastError
GetDiskFreeSpaceExA
GetCommandLineA
GetStdHandle

user32

DispatchMessageA
IsIconic
CloseWindow
DragDetect
GetKeyState
EnableWindow
DialogBoxParamA
GetMessageA
GetUpdateRect
GetScrollBarInfo
CreateMenu
CreateWindowExA
CopyImage
MessageBoxA

hlink

HlinkClone
HlinkCreateFromData
HlinkResolveShortcut
HlinkOnNavigate
HlinkCreateFromString

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ