6ff10046bd36dc534e8c5693fa00f360_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6ff10046bd36dc534e8c5693fa00f360_JaffaCakes118
Size

167KB
MD5

6ff10046bd36dc534e8c5693fa00f360
SHA1

395feb4b17cd408d05c98c734a5367e127f4f1a9
SHA256

f5ab2d16016a6b6f11b2e563da680bb707488f18e7df198f8cb076e311e8635e
SHA512

814d9033bd74a2ff70955f852a65a499c76f7b9b79afa1ba3d06575af52412db92f32b5a0557392ad128d71540dfcf03b4a515736dd7a53b2b9aa37d9f38ac9d
SSDEEP

3072:z1N1vRulgT1VR1gVCJnwaG+7fuwVDJ7FUm24BkKEAKen83p3HmtZUmN/D2ueY:pRumT1VR1gVCpwaG+7bDfxCK585HSUm9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ff10046bd36dc534e8c5693fa00f360_JaffaCakes118

Files

6ff10046bd36dc534e8c5693fa00f360_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ca4a9c4d91429eee005cc1d0035a7e3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

K:\mgresmecz\yStnQAeNKzSwE\iuQkzrgmj\ItbihvWjlEjf.pdb

Imports

kernel32

GetHandleInformation
GetFullPathNameW
GetModuleFileNameW
CreateWaitableTimerA
HeapWalk
HeapUnlock
SetThreadAffinityMask
GetACP
GetProfileIntW

shlwapi

PathUnquoteSpacesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

gdi32

FillRgn
DeleteObject
AddFontResourceW
CreateRectRgn

Exports

Exports

?MyDataFunc@@YGKXZ

Sections

.text
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug01
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ