754b06db8927dca8d52a515d75e23813_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

754b06db8927dca8d52a515d75e23813_JaffaCakes118
Size

1.1MB
MD5

754b06db8927dca8d52a515d75e23813
SHA1

9274e888b219e3469b012ad4a7e23e80a8e7be66
SHA256

360b0e0d3d8ed704663bbb29b7a25b7fe5dc4294c125e29a26a49339436a7b64
SHA512

cb226f929aebd6633cbc17c3deb6eca75c535f8fe17e0ad7463c1dac6e843a1baf314d89c833157742e2b5a193c62c8e57ce678c39b54d4575fe5e29fed1ea4b
SSDEEP

12288:YnTJEO/addH5WrxZwmbGKkNNFb81THUvwGjn8X2De4nVSRbEjVraes7pCmP6pY:YnTJT/adx56LWGTtGjahaNjVGRjL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
754b06db8927dca8d52a515d75e23813_JaffaCakes118

Files

754b06db8927dca8d52a515d75e23813_JaffaCakes118
.exe windows:4 windows x86 arch:x86

749e53eebef65052ef80e4ddf47a063a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetVersion
GetCommandLineA
GetCommandLineW
GetCurrentProcessId
GetSystemDefaultLangID
GetTickCount
GetUserDefaultLCID
GetCurrentThread
GetLastError
GetCurrentProcess
GetModuleHandleW
GetCurrentThreadId
GetUserDefaultLangID
VirtualAlloc
UnhandledExceptionFilter
GetOEMCP
WaitForSingleObject
GetModuleFileNameW

user32

ClientToScreen
GetSysColor
GetWindow
TranslateMessage
GetParent
LoadCursorA
InvalidateRect

Sections

.text
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 814KB - Virtual size: 813KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ