479d75586743dfa2751bfa2600aedced_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

479d75586743dfa2751bfa2600aedced_JaffaCakes118
Size

50KB
MD5

479d75586743dfa2751bfa2600aedced
SHA1

0175f8724ccdf0bc5930c83ffa1e05b797764bd6
SHA256

acf4525db4d0f70f211794c6ad34d0eee507e9e8cfd693b956427425950ee841
SHA512

8b38948d79e551b1a3d7f068b7f3624a5b31dc329507164b6df6a0266eeb4f846760c4710e2dde513a72cc343d3906228af71c153720f1993ada73274421fa4d
SSDEEP

384:T0boibgqbMNeLNek+vDq5giEyV/XldCEDcGwIlT3y6iIEQUOFgj:yD0yB/nT34IEogj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
479d75586743dfa2751bfa2600aedced_JaffaCakes118

Files

479d75586743dfa2751bfa2600aedced_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa6177423c56bdb1abfa5008a2c22ff8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeA
VirtualProtect
TlsGetValue
Sleep
SetLastError
CreateMutexA
GetDiskFreeSpaceExW
GetLastError
FreeConsole
FindClose
GetComputerNameA
GetCommandLineA
ReleaseMutex
CloseHandle
GetModuleHandleA
EnumResourceTypesA
GetExitCodeProcess
GetTickCount
LoadLibraryExW
DeleteCriticalSection

shell32

DragQueryFileA
ShellAboutA
StrChrA
DuplicateIcon
ShellMessageBoxA
SHGetSettings
DragAcceptFiles
DllUnregisterServer
SHGetMalloc
SHFree
SHGetDiskFreeSpaceA
ExtractIconA
DragFinish

printui

vPrinterPropPages
bFolderGetPrinter
vQueueCreate
bPrinterSetup
PnPInterface

user32

MessageBoxA

Sections

.text
Size: 1024B - Virtual size: 632B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fpjawav
Size: - Virtual size: 6KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE