8c653dd124cbfe129346d053c8eca667_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8c653dd124cbfe129346d053c8eca667_JaffaCakes118
Size

189KB
MD5

8c653dd124cbfe129346d053c8eca667
SHA1

aa438325dde8c70ec070e095c2669131aeae8601
SHA256

435bfc6cbd0198c11362b8482c50867ba15b86924165871d9aa9998616c5ae41
SHA512

804dc33c59394b9641b3a8a38ecbc1b77011903cc2395d193049fc0b4bc3839549b21d627cbb66ef79f9d1fdf45444fc08d6a1e1d40fe628c5301e5fb274cc2c
SSDEEP

3072:dgqG4YlpqLE0Gaq37twStaHvkAGot8Yx87QPAc5a:iqd3LLqjEPcdq3Pl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c653dd124cbfe129346d053c8eca667_JaffaCakes118

Files

8c653dd124cbfe129346d053c8eca667_JaffaCakes118
.exe windows:5 windows x86 arch:x86

94a9a5289654f0d5c0b21d86de1f2328

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

U:\baWagJZiGjnt\xinTTzwzeHjrhf\dwseljzoh\oeswbibf.pdb

Imports

kernel32

GetCommState
CreateFileMappingA
HeapSize
SetEndOfFile
DeleteFileA
VirtualProtect
SearchPathW

shlwapi

PathUnquoteSpacesW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

user32

CheckRadioButton
MessageBoxW

ntdll

RtlCaptureContext

Exports

Exports

?InsertCustomData@@YGKXZ

Sections

.text
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.code
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ