4bbba7056d4acaeb65c32ed2c487a189_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4bbba7056d4acaeb65c32ed2c487a189_JaffaCakes118
Size

363KB
MD5

4bbba7056d4acaeb65c32ed2c487a189
SHA1

b2524b605b541b83cfb6d31b13a55e36dced7c45
SHA256

da6b59a62aa3e866d0b6261ddd8a71f5bb4fd89738a8b9ce678db86f400ccbde
SHA512

3afad44689fc066dfd6ae1a82775cce8813d0d6c3ad456b17660955657140c0af20b9ce0e259f3c6a6262e3b2b2906180c744bd33816325a434dcc889e3a4627
SSDEEP

6144:9iJwnMGOr8fe0AJgjchjTnDqNkCYV7zj9nd56t6L8R8NmC:0+n9O8e0Fcx/bV7Pn5k+XNH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bbba7056d4acaeb65c32ed2c487a189_JaffaCakes118

Files

4bbba7056d4acaeb65c32ed2c487a189_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7daad91d273a51f762547091ab1e64b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
TlsGetValue
CreateMutexA
GetModuleHandleA
GetDriveTypeA
GetExitCodeProcess
EnumResourceTypesA
Sleep
CloseHandle
SetLastError
GetLastError
GetDiskFreeSpaceExW
GetComputerNameA
DeleteCriticalSection
GetCommandLineA
ReleaseMutex
FreeConsole
VirtualProtect
GetTickCount
LoadLibraryExW

shell32

DuplicateIcon
SHGetDiskFreeSpaceA
ShellMessageBoxA
DragFinish
DragQueryFileA
DragAcceptFiles
DllUnregisterServer
SHGetSettings
SHGetMalloc
StrChrA
SHFree
ShellAboutA
ExtractIconA

printui

vPrinterPropPages
PnPInterface
vQueueCreate
bPrinterSetup
bFolderGetPrinter

user32

MessageBoxA

Sections

.text
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ