68915decf229d4fb3b6cf3f8bca1c73b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68915decf229d4fb3b6cf3f8bca1c73b_JaffaCakes118
Size

123KB
MD5

68915decf229d4fb3b6cf3f8bca1c73b
SHA1

4e43d705a9f5e8828a1dca91c12a0eca85cce2d2
SHA256

d300c63a4664098f8433da6a96327d8daa4148c1a0b956e159d6c708458e135c
SHA512

4ad656bdb645c099e715a9664e1ffc5cf6462009bb9d2522240b848fea409e4326a9578cf5ba5ddbd3ec13c1abfc1dcfa772ae6c37337992ef89eac5c9a5716a
SSDEEP

3072:kzmEvZ89UXNUuwXFVpkI3cr3WBPW77hi7dpStrS:wbZ8oyFVnS36Px7dpSt+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68915decf229d4fb3b6cf3f8bca1c73b_JaffaCakes118

Files

68915decf229d4fb3b6cf3f8bca1c73b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f072c28ca5a10d7f10c7d2e9987b561

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
ClearCommError
CreateProcessW
ExitProcess
ClearCommError
ReleaseMutex
EnumResourceNamesW
CreateFileMappingA
ExitProcess
CreateMutexA
GetStartupInfoA
MapViewOfFile
QueryPerformanceCounter
GetModuleFileNameW

user32

CharNextA
GetMessageA
CharUpperA
SetTimer
PostThreadMessageA
PeekMessageA
KillTimer
LoadStringA

shlwapi

PathFindExtensionA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ