65e262ff6ea8c0157b6da5aa66f60e9d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65e262ff6ea8c0157b6da5aa66f60e9d_JaffaCakes118
Size

167KB
MD5

65e262ff6ea8c0157b6da5aa66f60e9d
SHA1

a1d8c7eff708a02bf244ec0c986b15a0d0dd35a3
SHA256

00ba804312a17ce1419d915d63eaa3e4963735aac9b32ae5a6c3d672ba03aed2
SHA512

2a85b3bd17fd15852d6218d01e030363c86d0a1994f958163bc6bb4068ef241c9f1462234e6b5ed8888d56da90dbcdd3ee0441cbf4b6e74c05290587b3c30068
SSDEEP

3072:UEqvGckQXucJ2uzRbWpnMG9Y6C9A1zxYezrjBeaEhB7vJD4Ju:nBcDXucbzRbW1vMuDwaqh4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
65e262ff6ea8c0157b6da5aa66f60e9d_JaffaCakes118

Files

65e262ff6ea8c0157b6da5aa66f60e9d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

98cceeea5e5876da496d3a199fa01b5b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\KrowXGuhNAS\vHssRkIywvy\resWjcsZGRZpk\lishSQsmhdVtjT.pdb

Imports

shlwapi

StrCmpIW
ChrCmpIW
UrlGetLocationW

kernel32

CallNamedPipeW
GetCommandLineA
LoadLibraryA
SetThreadPriority
GetModuleHandleA
lstrlenA
GetModuleFileNameA
SetCurrentDirectoryA

msvcrt

_controlfp
strstr
strcspn
__set_app_type
atoi
__p__fmode
__p__commode
_amsg_exit
_initterm
_ismbblead
_wtoi
_XcptFilter
_exit
_cexit
__setusermatherr
rand
__getmainargs
memset

gdi32

SetBitmapBits
OffsetRgn
EndPage
GetTextMetricsW
ExtTextOutA
Polygon

user32

IsCharUpperW
GetIconInfo
DefFrameProcA
DrawStateA
GetMessagePos
GetWindowDC
SendInput
BeginDeferWindowPos
wsprintfW

Exports

Exports

?CreateDlgMessage@@YGHPAXPADK|U

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ort
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 137KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE