3a3424c0946741abc59984dc7aa124f8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a3424c0946741abc59984dc7aa124f8_JaffaCakes118
Size

169KB
MD5

3a3424c0946741abc59984dc7aa124f8
SHA1

1a48a667c318a2e146d8f56a1022cb3e8ac62c28
SHA256

8007cff019561562e67d83a9d402af2e33ec1d6714449505eca55b193cca1c71
SHA512

4075c43b06f17d9c41b1db16bcd3c764002b9c13ccc4a221699298aaeea0a3c23a0fc1fc711c7ae14c5f4db1b5edd386fd657f8be8177ead29e230625697726e
SSDEEP

3072:JMms4aJ1af0dToJ4EMO01DJKlugXyAZu7UkpLfUD4P5pgTabrZc5Kw:JMmHajvOiNOiAZu7UAbU0PFVK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a3424c0946741abc59984dc7aa124f8_JaffaCakes118

Files

3a3424c0946741abc59984dc7aa124f8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3f8aa0307dd6d50be64afa8f80a10cad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

N:\Exyokorqviyxi\vzkiOLxEaOjI\NxkdlyyzF.pdb

Imports

kernel32

GetCurrentThread
MoveFileA
AddAtomW
lstrcmpiW
GetProfileIntA
GlobalUnlock
GetCompressedFileSizeW
GlobalLock
GetProfileStringA
GetUserDefaultUILanguage

shlwapi

PathUnquoteSpacesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

gdi32

AddFontResourceW
CreateRectRgn
DeleteObject
FillRgn

Exports

Exports

?MyDataFunc@@YGKXZ

Sections

.text
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug01
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ