479e24cca40a11824950cb194e2831ac_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

479e24cca40a11824950cb194e2831ac_JaffaCakes118
Size

6KB
MD5

479e24cca40a11824950cb194e2831ac
SHA1

f81c3daa31937209e251acae348d65ef3206b8b4
SHA256

c0564d54bc7e96b7ffdb48ff547e8d700dc35819cd51fc90db2e62ae91c71d44
SHA512

77c1bc91632e698cfc5289fd523ac8e6e215c9e25b4e7cdda6a9b2a0dcb0bf0e8a0b0158c8dab65077049a7b5055192a15ed62f280ff0a1fc3834467a432d5c0
SSDEEP

96:f7IzUtc+0wD7KTskZTss1VzFbLf4CbX8P/nnv/nnVpzycOyZ7ScN8yL:ENZwvOskBHVzF/XXcHdpSyZ7S88yL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
479e24cca40a11824950cb194e2831ac_JaffaCakes118

Files

479e24cca40a11824950cb194e2831ac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

54af23e32cbcaea6c1e89842f61d14f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryW
CreateFileMappingW
WritePrivateProfileStructW
WriteProfileStringW
VerLanguageNameW
GetConsoleInputExeNameA
lstrcmpiA
WriteConsoleOutputCharacterW
SetConsoleNumberOfCommandsW
CreateWaitableTimerA
FreeEnvironmentStringsA
lstrcmpW
CreateJobObjectA

user32

GetClassInfoExA
SendMessageCallbackW
RegisterClipboardFormatA
CharPrevA
CreateDesktopA
CreateWindowExA
RegisterClassA
DispatchMessageW

gdi32

RemoveFontResourceExA
GetGlyphIndicesA
GetKerningPairsW
EnumFontFamiliesExp
D�
T
�

Sections

.data?
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.icode
Size: 1024B - Virtual size: 975B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ