4e09d07525f28b02c6bf31e4485ece26_JaffaCakes118 | Triage

Sharing

General

Target

4e09d07525f28b02c6bf31e4485ece26_JaffaCakes118
Size

145KB
MD5

4e09d07525f28b02c6bf31e4485ece26
SHA1

7612587c99cf4e15a3c3e610ce2c718dd265f196
SHA256

3803c9e6ae2cbf60f25c7708f1d2d1471f2763f343d119ebbad1fc13a5219b39
SHA512

6e30d47bfd62fc75cf4f0bb433ae51cf71df1a2989500ad362215d753487991986a50ad210b53dbe9286350e32f2433fe09721ce04c801451776774c265c9bfb
SSDEEP

3072:wwoDRfPuFyVthVNdoJLsdGBT2q5sPRR/ng9NdXYvE:wTDRKkzdoJbT2q8TwdXYvE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e09d07525f28b02c6bf31e4485ece26_JaffaCakes118

Files

4e09d07525f28b02c6bf31e4485ece26_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d1ba396d80c849922b09d5d6b5016405

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
MapViewOfFile
FindResourceW
SizeofResource
GetFileAttributesA
CreateFileMappingW
CreateFileA
SetEndOfFile
SetFilePointer
FindNextFileA
GetModuleFileNameA
LockResource
EnumResourceNamesW
UnmapViewOfFile
VirtualQueryEx
FindClose
ExitProcess
FindFirstFileA
GetSystemInfo
GetCurrentProcess
GetTempPathA
ReadFile
CloseHandle

occache

FindControlClose

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

ole32

CoCreateInstance
CoUninitialize
CoFileTimeNow
StgOpenStorage
CoInitialize

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 1024B - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ