8d5a59cc9f7a23f5386884f243c27606_JaffaCakes118 | Triage

Sharing

General

Target

8d5a59cc9f7a23f5386884f243c27606_JaffaCakes118
Size

50KB
MD5

8d5a59cc9f7a23f5386884f243c27606
SHA1

16c2ad04d2b935c84f37e994d7954dca8d9205dd
SHA256

36c39e2f3f97cb4c582819e54831285b592dc143487bd8e5c4bedbb2ed441631
SHA512

40aa9e1c555f95898ff21d66b2dcc5d307922a0f8f0a0ffb29b14ed3fe1dd63bf62c949f4f2cba7f7158ef641b0ec01158c807e98ca27639ab7d2b946abcd639
SSDEEP

1536:9rZu46fRjPWw926hejYj2PfJPNBm/mbFCE:9r846fRjew9fejYjiz8o9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d5a59cc9f7a23f5386884f243c27606_JaffaCakes118

Files

8d5a59cc9f7a23f5386884f243c27606_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbd26b540560d2db206619140055f696

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SaveDC
TextOutW
SetRelAbs
StretchBlt
SetICMMode
ResetDCW
UpdateColors
SetDIBColorTable

wsock32

closesocket
WSAStartup
listen

kernel32

CreatePipe
TerminateProcess
VirtualProtect

shell32

SHAppBarMessage
StrRChrIA
StrStrIA

Sections

.text
Size: 30KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ