753c6e06f389cb5051af90d4fe8a0943_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

753c6e06f389cb5051af90d4fe8a0943_JaffaCakes118
Size

189KB
MD5

753c6e06f389cb5051af90d4fe8a0943
SHA1

bd50e100179a8719452a61978ec9fae4e155760c
SHA256

b95f31f96e3062d2fe81645a5f2d34fd2bb1fe16fb13cf680da5eead7c65b46c
SHA512

1d9d9e0e5ef207abaf65ca913ecb3fe241612f94bdb2ba19b2770cc33f939cbbedf5bfd57bf414fe4a1bbd0051009b77be9b2b8bc19cbde21166b5d43e4244ed
SSDEEP

3072:mJWrUa15ebgwib2MJDJ8s0qWm6vRa6B82DiN2ZHqscUQWAL4y5nIIWG:35eswibBDJ8s0qZ6Zv821HTQWvI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
753c6e06f389cb5051af90d4fe8a0943_JaffaCakes118

Files

753c6e06f389cb5051af90d4fe8a0943_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9a905e2a941f6551e76843922944f736

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
SetProcessPriorityBoost
GetModuleFileNameW
CreateEventW
WriteFile
DeleteCriticalSection
Sleep
EnumResourceTypesA
ReadFile
GlobalAlloc
CreateFileW
GetModuleHandleW
CreateProcessW
TerminateThread
GlobalLock
GlobalUnlock

imm32

ImmAssociateContext

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ