3bcf5c79712d77d285744b7abc8796d6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3bcf5c79712d77d285744b7abc8796d6_JaffaCakes118
Size

122KB
MD5

3bcf5c79712d77d285744b7abc8796d6
SHA1

2606a62e7742e34ae85bfe0c0c8f93cb93a28563
SHA256

66e575f6eb7d6cf47d0a23fbb09044a9aa2aa71121fcb70df02ce66a69b79150
SHA512

f0c2779906471178005b7e915ed6979ae271aa46890cd50cbb3df797a59880ef2bd8854873050f987eb2c7a574e1953cc34b9835525a13c988844b263a088a12
SSDEEP

3072:wXtdgu3tUi00MkU2DMn/5Ra4Y1LqK2I8zAvIy:wXtJ9Ui00Meq/5bY1Lq9IH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3bcf5c79712d77d285744b7abc8796d6_JaffaCakes118

Files

3bcf5c79712d77d285744b7abc8796d6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd0f1a321233e9911c1fd86fdab84433

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringW
CreateProcessW
ExitProcess
FormatMessageA
GetDiskFreeSpaceA
GetFileTime
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
IsDebuggerPresent
LoadLibraryA
VirtualAlloc
VirtualFree

user32

DestroyMenu
GetSysColor
UpdateWindow

gdi32

CreateHalftonePalette
CreatePenIndirect
ExtTextOutA
GetDCOrgEx
GetPaletteEntries
LineTo
SelectObject
SetMapMode

shell32

DragFinish
DragQueryFileA
SHAppBarMessage
SHChangeNotify
SHCreateDirectoryExA
SHGetMalloc
SHGetPathFromIDList
SHGetSettings
ShellExecuteExA

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1009B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ