889b70504feb4c98399d7febb455605f_JaffaCakes118 | Triage

Sharing

General

Target

889b70504feb4c98399d7febb455605f_JaffaCakes118
Size

164KB
MD5

889b70504feb4c98399d7febb455605f
SHA1

390099520b7e4406ac66d535471a49ab1e0c40b9
SHA256

95620a97585a8b04898c39dd0081de82204ec2315851cd9f94421db944d39d41
SHA512

f8eb654986982a1cee236e1d341703c5075598e7d4e8122be9bf00d134bfee26ada15b5be36f86e5e5c0fbcaac1929a71aa1528c39a62cb5291dfdb84ca90470
SSDEEP

3072:U02MNq2/G33P32mRenNJ0nwZ4+jfnlLAK3OV79FNRgL/ZnPv0AK2:dTlq3P3d+NJteifxH3ABRW/Fsd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
889b70504feb4c98399d7febb455605f_JaffaCakes118

Files

889b70504feb4c98399d7febb455605f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

357c5239c2047b419ee3faea88fef031

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\yzuXzzSm\wqXqjknDrywYG\kNdaBlrIfdo.pdb

Imports

kernel32

GetNumberFormatA
GetUserDefaultLCID
FindResourceExW
GetThreadLocale
GetProfileSectionA
GetThreadPriority
IsBadReadPtr
ReleaseSemaphore
GetProfileIntW
lstrcmpW

shlwapi

PathUnquoteSpacesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

gdi32

FillRgn

Exports

Exports

?ToTestFunction@@YGKXZ

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug01
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ