3e6e5302378cdfd6d2c861d258ac4fe3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e6e5302378cdfd6d2c861d258ac4fe3_JaffaCakes118
Size

102KB
MD5

3e6e5302378cdfd6d2c861d258ac4fe3
SHA1

2b68b4444f4a1f83afbc89966bc02c34f3283042
SHA256

8ff4772d4fe4e3c22bcdbb19e2ab56754d8f0401faaa468e4c2ea2b8ae98a614
SHA512

8ded06ceb15887554b914412bc7ac77f58d34506f0c0d440bd727e2e18b4ec0580901d3ebcc00748183fafbcf06ea96932223283a1216847ea78d135ea53ac13
SSDEEP

3072:LIYQlFuXUxLlBrDTVV9l+YQE7sTjn6zeT:L7QLuXQLlRPV/N7sSS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e6e5302378cdfd6d2c861d258ac4fe3_JaffaCakes118

Files

3e6e5302378cdfd6d2c861d258ac4fe3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

51d697cd69ce5e249d6dccb6ff6dcccb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

mciSendCommandW
sndPlaySoundW

kernel32

GetEnvironmentVariableW
GetVersionExA
ExitProcess
AddAtomW
GetVersionExW
TlsAlloc
GetConsoleMode
GetTempPathW
WriteConsoleW
TlsFree
CreateFileA
LoadLibraryExW
GetProcAddress
CreateFileW
EnumResourceNamesA
HeapAlloc
InterlockedDecrement
GetProcessHeap
CreateFileMappingA
GetModuleHandleW
MapViewOfFile
GetConsoleCP
SetLastError
GetModuleHandleA
InterlockedIncrement
IsBadStringPtrW
GetLastError
TlsGetValue
FlushFileBuffers
UnmapViewOfFile
TlsSetValue
HeapFree
Sleep

setupapi

CM_Get_Depth_Ex
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyA
CM_Get_DevNode_Status

shlwapi

PathAddBackslashW

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ