5f17e59d5033781645cecadf414967d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f17e59d5033781645cecadf414967d2_JaffaCakes118
Size

155KB
MD5

5f17e59d5033781645cecadf414967d2
SHA1

a0b49377499f2b288878cacd5082590d894c60b8
SHA256

668af123762721a48068fec50f2813142788f67ef6b5194b96de22be7ade6b67
SHA512

54177dbe3107abe65f2706502da4bc1ac4352a2a67d20e7a423cc44d3b65aad9c101a24b2a66e6b21131c7f0c4211c1b4c6851b105724e5e98808f100d2e9e49
SSDEEP

3072:QLhZfE/vv4IitDRfEoOjCB19JBoCZ9g+KBDseZ+fb3t:Q4/mfnOjCnBI+K+e8fh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f17e59d5033781645cecadf414967d2_JaffaCakes118

Files

5f17e59d5033781645cecadf414967d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ad0660c296e8c25fbe0953316fbf7592

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Acro_root_apms\Main\build\win\results\Release\info\template.pdb

Imports

kernel32

ExitProcess
GetCommandLineW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
LoadLibraryW
GetProcAddress
GetUserDefaultUILanguage

shell32

CommandLineToArgvW

msi

ord205
ord173

user32

MessageBoxExW

shlwapi

StrCmpW

Sections

.text
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE