473664d5a58849bee34140a85f5ba9db_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

473664d5a58849bee34140a85f5ba9db_JaffaCakes118
Size

59KB
MD5

473664d5a58849bee34140a85f5ba9db
SHA1

7897798a488518ed90f76914136bfc015cc0d882
SHA256

240359eae8a8bbd65c39eaa172ccd207a17c7f793f0288cbd85aad205fea135c
SHA512

871ff929df540dc44a63328afabf813ec4cf31cef5b44cd2578bb4b1d86ceb2bcfbcc8eb88875c2239e78226c4d88158b138b1084821015af7a93a95b44d2d86
SSDEEP

768:qvQALM5DIh3pO/YM/NK14mcthLKURCFOfzilEJ6bxe6j:qNL0DJt/N4rcHLrCFEilEcbjj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
473664d5a58849bee34140a85f5ba9db_JaffaCakes118

Files

473664d5a58849bee34140a85f5ba9db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

233d43c85d3e6d8c909589d1c7274413

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetCursor
LoadImageA
GetMessageA
DrawTextA

kernel32

SetEndOfFile
lstrcmpA
WriteFile
VirtualAlloc
TlsSetValue
EnterCriticalSection
EnumResourceLanguagesA
EnumResourceNamesA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
Sleep

ole32

CoInitializeSecurity
OleCreateLink
WriteClassStg
CoGetCurrentProcess

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 17KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE