342a0bb287d05a9bbe2dd72229b36ae8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

342a0bb287d05a9bbe2dd72229b36ae8_JaffaCakes118
Size

419KB
MD5

342a0bb287d05a9bbe2dd72229b36ae8
SHA1

a947dc23cf5ad7891309734ec20abbbc51273162
SHA256

f5ff9ce08846d05db43f8e8c5deeb9f2fa17645e884000a3ff1c1e94db576a27
SHA512

a16d9122f1957aa83019041b7bb7a8e2fda5edc0b274b9c280621912125c72262345e37878b9c36af4c1383da4e73323f9e9d986871199661102834a8be83013
SSDEEP

6144:aQzmNqegag/QB3eKj4bD2weTS29OR/Xac7G4nm5oQQ7S6iysj+rsQsTI2:KTsK4bDRShOlXJG4nm5oZ7SdyQ+rsQSL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
342a0bb287d05a9bbe2dd72229b36ae8_JaffaCakes118

Files

342a0bb287d05a9bbe2dd72229b36ae8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6b0d3945e2057189dfabca4048725ea5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathCommonPrefixW
UrlHashA
PathCompactPathA
PathAddExtensionA

kernel32

VirtualFree
ExitProcess
VirtualProtect
LoadLibraryA
VirtualAlloc
GetProcAddress

user32

GetForegroundWindow

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ