4094187ffd4173a1ba3652db8059200c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4094187ffd4173a1ba3652db8059200c_JaffaCakes118
Size

138KB
MD5

4094187ffd4173a1ba3652db8059200c
SHA1

5a643ae1aca786e1ef428f36c7e209c9ef27b3d6
SHA256

d5a00e0bc683b7887070a197716f6bbb762c3b92d56f4f6e6bff326250f9036f
SHA512

c090b95f98d883cafa700c6e075e9ced7ccaf747f6bd896b5a93d4c3a871f14edb592acaa4751c7b769c56ec9b3862e8ea15c8339f63d011a619552967d5a71e
SSDEEP

3072:ISz1TGk4hyX2+HmbNhgR032TAFY4by+7zIXrukQ2q5R:jNGnUhGjzb1zIrukQ35R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4094187ffd4173a1ba3652db8059200c_JaffaCakes118

Files

4094187ffd4173a1ba3652db8059200c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

90fe187561245e8a44567aae17e879af

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFindExtensionA

rpcrt4

RpcBindingFromStringBindingA
RpcBindingSetAuthInfoA
RpcStringBindingComposeA
NdrClientCall
RpcStringFreeA

kernel32

MapViewOfFile
ClearCommError
GetStartupInfoA
ReleaseMutex
ClearCommError
ExitProcess
EnumResourceNamesW
CreateMutexA
ExitProcess
CreateProcessW
QueryPerformanceCounter
GetExitCodeProcess
CreateFileMappingA
GetModuleFileNameW

user32

GetMessageA
PeekMessageA
PostThreadMessageA
CharUpperA
KillTimer
CharNextA
SetTimer
LoadStringA

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ