602f264d6b10ae6bbb600329196a7540_JaffaCakes118 | Triage

Sharing

General

Target

602f264d6b10ae6bbb600329196a7540_JaffaCakes118
Size

186KB
MD5

602f264d6b10ae6bbb600329196a7540
SHA1

b1000fff032ed89c35b0649889ff690e4c921fc0
SHA256

a0989e10e95d3c56d8d4e7380ca0164814c269182c0a305a41d2e5647fb4044e
SHA512

361ff8ea09cbcb84da77d039bdeb80bd7c390d416d16abaac6936de856d0b02dc7033b402b9f4d260e8e1be9afbd95f13cb2b0c7bf37e479d456e44ff5b0c5b4
SSDEEP

3072:89Yi7bzXxPLKimM5CqrTD0DcSAGxq69R4essgfXx4oUuNHHn+LcY5:JirJbmM5P/D0QGg8hsPx4oRNn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
602f264d6b10ae6bbb600329196a7540_JaffaCakes118

Files

602f264d6b10ae6bbb600329196a7540_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4e9a2b727dfa57f064bb3d1995b4d2d7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetProcessPriorityBoost
TerminateThread
ReadFile
Sleep
GlobalLock
CreateFileW
WriteFile
EnumResourceTypesA
GetModuleFileNameW
CreateProcessW
CreateEventW
GlobalAlloc
GetModuleHandleW
InterlockedDecrement
DeleteCriticalSection
GlobalUnlock

imm32

ImmAssociateContext

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ