41ff27eb3df266c0336c1f6adfd71c9e_JaffaCakes118 | Triage

Sharing

General

Target

41ff27eb3df266c0336c1f6adfd71c9e_JaffaCakes118
Size

201KB
MD5

41ff27eb3df266c0336c1f6adfd71c9e
SHA1

2ddbfe26bfedbfbc83bd0b2764b44a66f5547132
SHA256

95b8ab657048db6c796149ea599506fc362819eefcb92f4b1415c16f627ae8b6
SHA512

b4c1b7fd0fadd93b5d3607f5e8eac16ad947cb8c16aa703a6d984b195a53e3f2da992f89dbe9ab5bf9f9df199799a321a98dc57d5f1e322e7ce6c2a2e5cb7a48
SSDEEP

3072:Vez6pd7f+do9KpZQOW33R4Kh1xmRFF4pvYLU6CrTXcT2lhO:C6pdbIuOaR4YSL2r7F/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41ff27eb3df266c0336c1f6adfd71c9e_JaffaCakes118

Files

41ff27eb3df266c0336c1f6adfd71c9e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9365d6477826c643b791a8fcc163a460

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetDC
CharNextA
GetDesktopWindow
GetSystemMetrics

kernel32

lstrlenW
GetProcessHeap
SetCurrentDirectoryA
GetWindowsDirectoryA
Sleep
MulDiv
GetACP
GetVersion
GetLastError
GetCurrentProcess
lstrcmpiW
GetCurrentThreadId
GetStartupInfoA
RemoveDirectoryA
lstrcmpiA
DeleteFileA
lstrlenA
SetLastError
GetCurrentThread
GetThreadLocale
QueryPerformanceCounter
IsDebuggerPresent
GetDriveTypeA
GetCommandLineW
GetCommandLineA
DeleteFileW
GetUserDefaultLangID
GetOEMCP
GetConsoleOutputCP
GlobalFindAtomA
CopyFileA
GlobalFindAtomW
GetCurrentProcessId
LoadLibraryW
GetModuleHandleW
lstrcmpA
GetModuleHandleA
GetTickCount
VirtualAlloc

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ