3f61e048a67c9238eae7cea847ce109d_JaffaCakes118 | Triage

Sharing

General

Target

3f61e048a67c9238eae7cea847ce109d_JaffaCakes118
Size

185KB
MD5

3f61e048a67c9238eae7cea847ce109d
SHA1

efae1b854a4bb600d22b0b108d6163006e1b3c84
SHA256

cd6cb8a90a35eb03948bbb17eea5403662fc4ae42476cdcfd0105d34b374df51
SHA512

f2987738b2e5fbc8d09d909ffe5b04c4d4c3da6a1ee481c42a31211c4e3c278021bb7e6b2941e54de2aff0348871d5d593af3e2b200fd0a23a9d4235cc65cc18
SSDEEP

3072:cK/4nmIxYZSuEw09jdlmh4OvTOYRshgWfB7IG3J:S3O0/BjzmPvT5RshgWiG3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f61e048a67c9238eae7cea847ce109d_JaffaCakes118

Files

3f61e048a67c9238eae7cea847ce109d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

04c594a36535b6f287c7420edc96308b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Installation\Setup\Directory\Setup.exe

Imports

msvcrt

fputc
wcscat
__setusermatherr
__p__commode
__p__fmode
strspn
__set_app_type
_controlfp
wcstol
_ismbblead
exit
_initterm
_amsg_exit
strcspn
_cexit
_exit
free
_XcptFilter
__getmainargs

kernel32

MoveFileA
RegisterWaitForSingleObject
lstrcpynA
FindNextChangeNotification
lstrcmpW
SetupComm
FormatMessageW
EscapeCommFunction
SetFileTime
GetDateFormatW
PulseEvent
SetFileAttributesA

Exports

Exports

_UnregisterPowerSettingNotificationUnregisterPowerSettingNotification@0
_UnregisterPowerSetting_Notification@0

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.txtdat
Size: 512B - Virtual size: 271B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ