3db1899c099d9da3f185f28837ca4b44_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3db1899c099d9da3f185f28837ca4b44_JaffaCakes118
Size

133KB
MD5

3db1899c099d9da3f185f28837ca4b44
SHA1

0f02b96c0aa0beaf6b02fe8d1bf7e955236574c4
SHA256

8d388bd42f7212bb9ada562f9592209ea3a00cef4cf32cefc5f7de8e96454a65
SHA512

66d4688651f534d887d4ccdbeac178b9894226a8d616cc724c0ce63cfa5b5c7b756f00dbfa816b28a2043959380535f0a73654a5283bb1c4dceaee6508fbf31a
SSDEEP

3072:U0eXPHLDiLe7YnPyyV0I3yMDRsHFnPyMM6BcnS:UhHqLHPuICWRsHFnPPZcnS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3db1899c099d9da3f185f28837ca4b44_JaffaCakes118

Files

3db1899c099d9da3f185f28837ca4b44_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cae52b1fbdbe6caf9b81735fc26983e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

PeekMessageA
SetTimer
PostThreadMessageA
CharNextA
CharUpperA
KillTimer
GetMessageA
LoadStringA

rpcrt4

RpcStringBindingComposeA
RpcBindingSetAuthInfoA
RpcBindingFromStringBindingA
NdrClientCall
RpcStringFreeA

kernel32

ClearCommBreak
CreateFileMappingA
CreateMutexA
ClearCommBreak
QueryPerformanceCounter
CreateProcessW
GetExitCodeProcess
EnumResourceNamesW
GetStartupInfoA
ExitProcess
ExitProcess
ReleaseMutex
MapViewOfFile

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ