3e3a4809cfe2140522c6a621466c4580_JaffaCakes118 | Triage

Sharing

General

Target

3e3a4809cfe2140522c6a621466c4580_JaffaCakes118
Size

236KB
MD5

3e3a4809cfe2140522c6a621466c4580
SHA1

976fd8b0c36f7ef2ee826af9e57b6d7da66641da
SHA256

17cecbd90bd4cb7900076adbe6144adcd291e8c06cb3e509edc2c746585dbd90
SHA512

c94681a6602fa98ea082f75d7139f4ef486134344b5c4434d25186f46296b5797d29729b708cf5932661babab1f929493fc4794045b6265b51e36b2a31e7b12a
SSDEEP

3072:09TFbMFjghPSYiAFfe/BfnWuIkUQ57DMeJG6EtakU2bG2BeRjgQjqAeLIjXONI:09TWKbIZeB2EdW2NeCAeEjXON

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e3a4809cfe2140522c6a621466c4580_JaffaCakes118

Files

3e3a4809cfe2140522c6a621466c4580_JaffaCakes118
.exe windows:5 windows x86 arch:x86

102103f16cb774fa36dcedc2051fe730

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
IsDebuggerPresent
CopyFileA
lstrcmpiA
GetDriveTypeA
lstrcmpiW
SetLastError
GetThreadLocale
lstrlenW
lstrlenA
GetOEMCP
GetVersion
GetStartupInfoA
GetTickCount
GlobalFindAtomW
GetCommandLineA
lstrcmpA
QueryPerformanceCounter
SetCurrentDirectoryA
GetConsoleOutputCP
DeleteFileW
RemoveDirectoryA
GetModuleHandleA
GetCurrentThreadId
GetUserDefaultLangID
LoadLibraryW
GetWindowsDirectoryA
GlobalFindAtomA
DeleteFileA
GetProcessHeap
GetACP
GetModuleHandleW
GetCurrentThread
GetCurrentProcess
GetCurrentProcessId
GetCommandLineW
VirtualAlloc
Sleep
MulDiv

user32

GetDesktopWindow
GetSystemMetrics
GetDC
CharNextA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ