307223156cd305fe29c0e2c29b55bae8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

307223156cd305fe29c0e2c29b55bae8_JaffaCakes118
Size

223KB
MD5

307223156cd305fe29c0e2c29b55bae8
SHA1

3d227778a02173f3a2d58a2989fabc00f7ad8006
SHA256

5b85ec69d077e3ae81678c48f985813bed1e4a668b82f745ede99ba8c9143ec4
SHA512

b6c6358928e1caef30b42f6fbeb3b59f316c1ba8cfd771dd8e5ba3e4263d387ab0809265c3af4dab333dcb6f761f1d86897dc1f89d42598539a91ec05c5863bc
SSDEEP

6144:tsH3vZSKeSVuCurrqGRc/gugXMaI5vH+UFfTg:uUcVNu7K83qG0f8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
307223156cd305fe29c0e2c29b55bae8_JaffaCakes118

Files

307223156cd305fe29c0e2c29b55bae8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5b682f3e87770eacebc2e2e92d8fc8f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

user32

GetWindowWord
EnumChildWindows
SystemParametersInfoA
FindWindowExA

ole32

CoTaskMemFree

wintrust

WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData

kernel32

GetComputerNameW
GetWindowsDirectoryA
ClearCommError
FindFirstFileA
ExitProcess
DeleteFileA
FindNextFileA
FindClose

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shell32

CommandLineToArgvW

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ