70b0d7f01243bc9eb9cfc4b9b9ebda50_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

70b0d7f01243bc9eb9cfc4b9b9ebda50_JaffaCakes118
Size

204KB
MD5

70b0d7f01243bc9eb9cfc4b9b9ebda50
SHA1

6b85c65a65b276ce0f68af1f2e542f1523cb23fa
SHA256

84cb7776815836d00324d60a06a646be4f5e0fecea3ff6ec1b5be69c9ab21929
SHA512

4553ab61bbc3710cf9dd5d1113ca46dfbde281d7a2107244a070f11737d037b026240bd2fcff7fe68ab6b8fcbdbb1579fdbdb447aa777f6502e220814472566b
SSDEEP

6144:FUfNENeid87ZEkJvq0wuPsIyJ3NH9TRH32+:qfmke6ZEktjhPslBDTRH32+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70b0d7f01243bc9eb9cfc4b9b9ebda50_JaffaCakes118

Files

70b0d7f01243bc9eb9cfc4b9b9ebda50_JaffaCakes118
.exe windows:4 windows x86 arch:x86

97674422683ae9d425f7da1f6abb330b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetExitCodeProcess
HeapSize
GetCurrentThread
VirtualFree
LoadLibraryA
VirtualAlloc
VirtualProtect
PulseEvent
GetProcAddress
GetModuleHandleA
GetLastError
ResetEvent
VirtualAllocEx
TerminateThread
GetCurrentProcessId
LocalLock
VirtualLock
OpenMutexA
IsBadCodePtr

user32

LoadIconA
LoadStringA
DispatchMessageA
GetTopWindow
BeginPaint
SetTimer
ReleaseDC
LoadCursorA
GetDesktopWindow
GetDC
GetCursorPos

shell32

DuplicateIcon

ole32

CoInitialize

psapi

EmptyWorkingSet

msvfw32

ICOpen
DrawDibOpen
DrawDibClose
DrawDibEnd

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ