74a4b6db2cf63e897b401221d3cd8943_JaffaCakes118 | Triage

Sharing

General

Target

74a4b6db2cf63e897b401221d3cd8943_JaffaCakes118
Size

114KB
MD5

74a4b6db2cf63e897b401221d3cd8943
SHA1

c704a91cf3f45b2e5d89ed598dabe6068d6e4e55
SHA256

afc06b42e96630d975d46d924ba756b347eb585b4956bc4602f765577d377013
SHA512

10f181f11d4965d9bd717b5f75a64edb12dfc9ff01fca7c00c63d534dad9e55c25cb78d98a67761505f8fbcb50f38475c8176fbef1aefb3213e306075e6c6ac0
SSDEEP

1536:4CjSIvl2jykvRPFI6Vr8kxhKXo914ApFD7OFytNrMJ8iD/SuELodmDAhSIp5YDgD:4qMjVRPbnhKM1D5yUXrMJtDfd/0Vg0U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74a4b6db2cf63e897b401221d3cd8943_JaffaCakes118

Files

74a4b6db2cf63e897b401221d3cd8943_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2af73622d601441a01d7600890b06b13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessIoCounters
GetCurrentProcess
GetTickCount
GetCommandLineW
IsDebuggerPresent
GetStdHandle
GetProcessVersion
GetCommandLineA
GetProcessPriorityBoost
GetModuleHandleW
GetProcAddress
GetModuleHandleA
GetStartupInfoW

user32

IsWindow
GetParent
IsIconic
AnimateWindow
IsChild
CloseWindow
OpenIcon

shlwapi

PathGetArgsW

msi

ord194

msvcrt

_wcmdln
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
_initterm
__p__commode
_adjust_fdiv
_exit
_XcptFilter
exit
__wgetmainargs
__setusermatherr

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 99KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ