3b030f869beffc6d1360b07c161beb36_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b030f869beffc6d1360b07c161beb36_JaffaCakes118
Size

92KB
MD5

3b030f869beffc6d1360b07c161beb36
SHA1

6d861eef5e8028740f285622cb48a42c2fea11ef
SHA256

fde6e6c631e335c58fb5e0b144093d4ddd1f6aa7267747712a3f1421be03a0a0
SHA512

c6a658e70ca8e1c0b4c7b987594aa91a20934ec8a33a28753558c1022d8b89ab12dec97cd4ca605307e65bcfc0b5eb9386708752204a42358073b5398e4d92f4
SSDEEP

1536:5sJS74/GRYLL/YFbAbn3Samcp+gQR82L4/AkwYUNw1JWKAOfGDMQ:eJS7FlbAbi4HQqg4/33UNMJURDMQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b030f869beffc6d1360b07c161beb36_JaffaCakes118

Files

3b030f869beffc6d1360b07c161beb36_JaffaCakes118
.exe windows:5 windows x86 arch:x86

74835f6130ad8be30ca46de6588c77cf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFileInfoW
ShellAboutW
ShellExecuteW
DragAcceptFiles
DragFinish
DragQueryFileW

ntdll

NtClose
NtCreateFile
NtFsControlFile
NtOpenFile
NtQueryDefaultLocale
RtlAllocateAndInitializeSid
RtlFreeUnicodeString
RtlInitUnicodeString
RtlIsDosDeviceName_U
RtlNtStatusToDosError
NlsMbOemCodePageTag
RtlUnicodeStringToOemString
RtlUnwind
RtlUpcaseUnicodeString
RtlxUnicodeStringToOemSize

user32

CharLowerA
IsCharAlphaNumericA
LoadStringA
CharUpperA
wsprintfA

Sections

.text
Size: 4KB - Virtual size: 812B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 482B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ