60c9e8b382f40e981b8b17acc086c9e9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

60c9e8b382f40e981b8b17acc086c9e9_JaffaCakes118
Size

123KB
MD5

60c9e8b382f40e981b8b17acc086c9e9
SHA1

da712c2fba83b11e900ce3c33b25e81a9aa5b711
SHA256

49b80b1998b67643017481a1306bc4c229564c8847fe5ea4528fed8cba38e18c
SHA512

be9603736c50881236e89bca8cad0c07dea5c44f8940d64785e211f61ad69fab519eb1f14ecee208adaac81372279b4b7c41bd69120a0ad8d5be86aff25aa701
SSDEEP

3072:Y8scDr4c+RBOR8uRdcUumLe4VE0JyZE3IxeC:VdDrmBcdq4VEXEq/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60c9e8b382f40e981b8b17acc086c9e9_JaffaCakes118

Files

60c9e8b382f40e981b8b17acc086c9e9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c5d40a6a07b3b636efd3e3eebb537395

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetConsoleOutputCP
CompareFileTime
SetVolumeMountPointA
SetTimeZoneInformation
CloseHandle

ntdll

RtlTraceDatabaseEnumerate
RtlIsValidIndexHandle

user32

SetCursorPos

advapi32

ControlService

gdi32

SetTextCharacterExtra
SetStretchBltMode
SetROP2
SetLayout
SetBitmapBits
SelectClipPath
IntersectClipRect
GetTextColor
GetStretchBltMode
EnumObjects
DeleteObject
DeleteDC
CreatePatternBrush
BitBlt
ArcTo
AddFontResourceW
AbortPath

shell32

SHGetSpecialFolderLocation

inseng

CheckTrustEx

Exports

Exports

AOHNHnNme0ZZ31rq
GMWc2oZnJjV
Kcy
e8tzmo3

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE