653025c3ae13b8b78092d43a28d93000_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

653025c3ae13b8b78092d43a28d93000_JaffaCakes118
Size

36KB
MD5

653025c3ae13b8b78092d43a28d93000
SHA1

195a52de163feb77373e595b62103b178dd731e9
SHA256

2f0e967eafb310777824224ac446ff5c8a008523dfe4324801f5755218bf647c
SHA512

bc078c69aaa569a9e82a2ce3d9cf385798af9fbfef3f566c407244e3bf0df096058312f59c1ff5abaa39b474031d5a49093eb03facd3f043a5c3449fc63d3342
SSDEEP

384:Oq6kR/2ScFW0c88M+MwGd3R3Ulqt+E54KUtlF6HPPVo065aXbyXowKaauE1M:dHNchc8lldh3UwRrWw1oV5aXuXowPaX6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
653025c3ae13b8b78092d43a28d93000_JaffaCakes118

Files

653025c3ae13b8b78092d43a28d93000_JaffaCakes118
.exe windows:4 windows x86 arch:x86

91715d511be9701d1e54bc849b65ac8b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
lstrcatA
lstrcpynA
Sleep
LoadLibraryA
GetModuleHandleA
GetCommandLineA
TlsGetValue
ExpandEnvironmentStringsA
lstrcpyA
GetModuleFileNameA

user32

KillTimer

gdi32

DeleteObject

comdlg32

ChooseFontA

ole32

CoInitialize

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ