751060170b5936dd3c2fa0ce74d9cb3a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

751060170b5936dd3c2fa0ce74d9cb3a_JaffaCakes118
Size

166KB
MD5

751060170b5936dd3c2fa0ce74d9cb3a
SHA1

a13d59241a300ca9f199b83df8e0317065908952
SHA256

4e09f9c49e491984a4bd9b2f355c068ee2ff7e41ad149ac6594c8f825663b472
SHA512

1ce22c75fdfb9843f520375687550c711f4699db2c2f0856feb3a10ac157261f7fe7002a8d7800f46be648cfd7d18bc839cf85065fe6a17d6a89fae244ce7fcb
SSDEEP

3072:EMQiCd2Kn6SqWR3qWaAcXOoA9Z9MrclxYg12E4kOoDBH2gIuK0gE893Yd:EMGCS9Z9mCBvDN2gIuK9gd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
751060170b5936dd3c2fa0ce74d9cb3a_JaffaCakes118

Files

751060170b5936dd3c2fa0ce74d9cb3a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6695fe53ec7c5a9fbbb9365b54c1e875

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\zUmZIybkgfegq\fljfzgzzHzi\sbBHKkqdo\QlilmfotxZgz\gqeLJNRnfvlEWa.pdb

Imports

shlwapi

ChrCmpIW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_amsg_exit
remove
iswdigit
_initterm
_ismbblead
_XcptFilter
_exit
_cexit
__setusermatherr
vsprintf
strlen
__getmainargs

user32

CharUpperBuffA
SendMessageTimeoutW
TranslateMessage
OpenDesktopW
CallWindowProcA
GetNextDlgTabItem
IsCharUpperW
GetWindowDC

kernel32

LoadLibraryW
CopyFileW
GetModuleHandleW
GetModuleFileNameA
SetSystemTime
ClearCommBreak
LoadLibraryExA
GetLocaleInfoW
LoadLibraryA
ResetEvent
lstrlenA

gdi32

StartPage
GetTextMetricsW
OffsetRgn
GetDIBColorTable
SetViewportExtEx

Exports

Exports

?CreateDlgMessage@@YGHPAXPADK|U

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hill
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 137KB - Virtual size: 394KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE