837e23c322752e66071bd3291b1f3f34_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

837e23c322752e66071bd3291b1f3f34_JaffaCakes118
Size

3.3MB
MD5

837e23c322752e66071bd3291b1f3f34
SHA1

8c9d0067b15507660133d014efb98417283796e3
SHA256

a1c62b2aefc14012d797189378592aa8bffd2dc9f8fbc4e727368c5d22810668
SHA512

865dc5f3dc73809bb5dc5e01af84e1550e92c3c85104cf835cb5331af30042540150088888b4504d83549e78f32b26d067ec04c7bfeb7b5c02446e4e3c5b8eca
SSDEEP

49152:vQcVFSzimQ/GnMbcP9o+1h6Vz4eg078B1rywI/v:v3SziN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
837e23c322752e66071bd3291b1f3f34_JaffaCakes118

Files

837e23c322752e66071bd3291b1f3f34_JaffaCakes118
.exe windows:4 windows x86 arch:x86

41949cca8955063f512ca339bd408603

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateWindowExA
IsDialogMessageA
DispatchMessageW

kernel32

GetCurrentProcessId
ExitProcess
ReadFile
VirtualProtect
HeapAlloc
GetCurrentThreadId
GetVersion
SetFileAttributesW
GetTickCount
GlobalLock
GetModuleHandleA
SetConsoleCP
TlsAlloc
GetCommandLineW
lstrlenW
TerminateProcess
RtlUnwind
GetOEMCP
SetStdHandle
GetACP
GetCommandLineA
GetStartupInfoA
FreeLibrary
CreateEventW
GetVersionExA
DisableThreadLibraryCalls
LeaveCriticalSection
GetEnvironmentStringsW
IsValidLocale
GetProcAddress
LoadResource
GetLocalTime

gdi32

CreateCompatibleDC
StretchBlt

ole32

CoTaskMemRealloc
CoTestCancel

lz32

LZClose

Sections

.text
Size: 681KB - Virtual size: 680KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE