652b4e9f16ce63b2b57cccc3700999a1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

652b4e9f16ce63b2b57cccc3700999a1_JaffaCakes118
Size

32KB
MD5

652b4e9f16ce63b2b57cccc3700999a1
SHA1

2175b384969271768beeff78dcd86654f4cfed04
SHA256

4320b4d4ef338dca351fb146e698cc463949933305c8bc8f5de41c5d4f284c01
SHA512

61c8897fa0b2549389cd09363eb0f0f2701ef9f63619d2df5757c554c3e118a3ca9cc16ed6ca6e0b434af08b7c0c1011af4d746fed6d0cc8156df571718a72e3
SSDEEP

384:uuGg5JsCz0BA5Hj41VNGLlTrRLK9oZMZwEOXCWTqfW:Gg5eCMANj2oLl/dK9GRXCW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
652b4e9f16ce63b2b57cccc3700999a1_JaffaCakes118

Files

652b4e9f16ce63b2b57cccc3700999a1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

321dfaa2fa65476caacb9dc35086796b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeA
TlsSetValue
CreateMutexA
TlsAlloc
SetEvent
CreateEventA
GetStartupInfoA
ResetEvent
GetCurrentProcessId
GetLastError
GetLocaleInfoA
TlsFree
GetSystemInfo
TlsGetValue
WaitForMultipleObjects
IsBadReadPtr
InterlockedCompareExchange
ReadFile
CreateFileA
VirtualAlloc
ExitProcess
LocalFree
FormatMessageA
GetModuleHandleA

user32

wsprintfA
MessageBoxA

ole32

CoTaskMemRealloc
CoInitialize
CoUninitialize
CLSIDFromString
CoCreateInstance
StringFromGUID2

oleaut32

LoadRegTypeLi
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
LoadTypeLi
SysAllocString

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ