897e564c0365b4f6adcd416a799eba43_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

897e564c0365b4f6adcd416a799eba43_JaffaCakes118
Size

186KB
MD5

897e564c0365b4f6adcd416a799eba43
SHA1

8bb8485191d80932bbd79b2c6a6f6132c27e6f98
SHA256

25ad6a459383284bee548fd79523bc9f8d3155a9bc180e9b18d4c0d337bdc052
SHA512

81a055d69a7002d2b568459ede72a3bd4d7c160780f90516556af318e9b6bbe43718dda4dba65ad3f9be4ce805a7ea761537b85e4a0cf61964c0f71b4f8a06e3
SSDEEP

3072:4gFSGDkSWvpfCoz3CmEeY7bpt/W1WYpUuJt8ZfHuvb9iAVu4HdN6HiL1yC/s:vY1BzSmEeY/rWIHat8Zmb9tVvb5xy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
897e564c0365b4f6adcd416a799eba43_JaffaCakes118

Files

897e564c0365b4f6adcd416a799eba43_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1f4f119375e5fa15ec56fb28f5aef184

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalGetAtomNameA
VirtualAlloc
IsValidCodePage
GetConsoleOutputCP
HeapReAlloc
RtlUnwind
GetTimeFormatA
GetLocaleInfoA
GetDateFormatA
GetACP
MultiByteToWideChar
TlsSetValue
EnumResourceNamesA
GetOEMCP
GetModuleHandleW
TlsAlloc
HeapSize
SetStdHandle
WriteConsoleA
TlsGetValue
SetFilePointer
GetCPInfo
RaiseException

occache

FindControlClose

shell32

SHGetFolderLocation
DragAcceptFiles
SHGetSpecialFolderLocation
ShellExecuteW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetDesktopFolder
SHAppBarMessage
SHGetFileInfoW
Shell_NotifyIconW

Sections

.text
Size: 88KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ