8caba9fb1d1f49ac93c0405691216d23_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8caba9fb1d1f49ac93c0405691216d23_JaffaCakes118
Size

397KB
MD5

8caba9fb1d1f49ac93c0405691216d23
SHA1

d1d5309a611148afa23b28ff6205dfd4627a131f
SHA256

7a4f8b9d46ccf2ee0c6eb78b099eb9c09db6f63277b30d39beb3780e1b2f31ae
SHA512

dad0b623a86e5bce459d1051e874209165ae7987c04846483778738a8a9dd13aaafdfc73750376ac7c67bdc29d29eb178db02b67982034e3191cebde30b70973
SSDEEP

6144:3xvO2GBFWWQXSqtLU8cwhGlSsr6c66lfSK/PpsWSnpL7mqO:JgBFWWWCl0cBfSRWSngq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8caba9fb1d1f49ac93c0405691216d23_JaffaCakes118

Files

8caba9fb1d1f49ac93c0405691216d23_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e311062b6161fffabc318887554d6d1f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
LocalAlloc
ExitProcess
QueryPerformanceFrequency
RaiseException
GetTickCount
GetCurrentThreadId
DeleteCriticalSection
GetThreadLocale
InterlockedExchange
RegisterWowExec
GetVersionExW
InitializeCriticalSection
CopyFileW
GetLocaleInfoA

user32

PostMessageW
KillTimer
GetFocus
TranslateMessage
LoadIconW
OffsetRect
LoadMenuW
EnableMenuItem
GetWindowPlacement
ReleaseCapture
IsWindowVisible
PtInRect

odbc32

SQLGetTypeInfoA

Sections

.text
Size: 256KB - Virtual size: 255KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ