781f807a664cc8de936faea5fa3a5880_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

781f807a664cc8de936faea5fa3a5880_JaffaCakes118
Size

806KB
MD5

781f807a664cc8de936faea5fa3a5880
SHA1

0733a787f60c895cc0b040b4435a2f4ca97adbf7
SHA256

9b7613c6e5462a89c728f9c028d4da90336d008756382d7d744a0bc7d3d8df73
SHA512

c9700a196821ca3e8d9438dbde91d73258c3455a970f320f8667b37bda628f9805079d0da0df7742fe24875a049684e690da7706dfd570e95f0fce7bcd0d38df
SSDEEP

24576:NfhpZbEvTxit3Um2klapg9EiD/iWEv3P7:JhpVEvTxO7do0EiD/bc3P7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
781f807a664cc8de936faea5fa3a5880_JaffaCakes118

Files

781f807a664cc8de936faea5fa3a5880_JaffaCakes118
.exe windows:4 windows x86 arch:x86

386ddd406396de183f426380affbeca9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetModuleHandleW
LocalSize
GlobalFree
ResumeThread
GetACP
LocalFree
GetDriveTypeW
GetEnvironmentVariableA
CloseHandle
FreeConsole
CreateThread
WriteFile
FindVolumeClose
InterlockedExchange
ResetEvent
GetPrivateProfileIntW
lstrlenA
GetMailslotInfo
GetExitCodeProcess

user32

GetClassInfoA
CreateWindowExA
GetSysColor
DrawStateW
IsWindow
DispatchMessageA
GetKeyboardType
GetClientRect
EndDialog
CallWindowProcW
GetSysColor
SetFocus
GetCursorInfo

msexch40

DllUnregisterServer
DllUnregisterServer
DllRegisterServer
DllUnregisterServer
DllUnregisterServer

hdwwiz.cpl

InstallNewDevice

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 797KB - Virtual size: 796KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ