649a91523b7630a519609361c2fc69f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

649a91523b7630a519609361c2fc69f4_JaffaCakes118
Size

181KB
MD5

649a91523b7630a519609361c2fc69f4
SHA1

fbb6c4d5742c5a6a9bee4d119fbe6c99ab78e422
SHA256

ff9554b1c50ac1f10672a911204930434d81f92b181d1e434721ee94c2f2bf67
SHA512

66279b83935b541ba38259c3120c52557523ee89619880a498afa566484ef134b64bb77d99ee4450d7a5bfe986aba975d4742e8b6e96c559dd1cc0c0cb093253
SSDEEP

3072:4SJ7H/UAgDf24i0dExxv+bXddj+VqCKTlw43ii0DjTG:4m7H8/qHjv+zCKZwe0D/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
649a91523b7630a519609361c2fc69f4_JaffaCakes118

Files

649a91523b7630a519609361c2fc69f4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ed9b918a86b02a3b4effd60b3cd76f32

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
HeapCreate
LeaveCriticalSection
GetCalendarInfoW
HeapReAlloc
GetACP
HeapDestroy
VirtualFree
EnterCriticalSection
GetCPInfo
ExitProcess
EnumResourceNamesA
HeapSize
RtlUnwind
GetStartupInfoA
DeleteCriticalSection
GetOEMCP
FreeEnvironmentStringsA
SetEndOfFile
RaiseException
InitializeCriticalSection
IsValidCodePage
ReadFile

rpcrt4

UuidCreate

ole32

CoGetMalloc
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoQueryProxyBlanket
StringFromGUID2

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ