8e71d5b926acf11e28a8a05df82b9f2d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e71d5b926acf11e28a8a05df82b9f2d_JaffaCakes118
Size

69KB
MD5

8e71d5b926acf11e28a8a05df82b9f2d
SHA1

07e59efa5b9f77f2c92199c0d08e0d33efb454e4
SHA256

61229ca14620a942933186fc0f8bb064c07c24896554e9a9b27152e5d63c9e0b
SHA512

d3570ae0b5a64a49c4733d397d364a345aeaad9ffc55d980276345a413f41a602f05ae898b40090c62a975696b8207485b8471173eaadb7686c5334f260a73b2
SSDEEP

1536:7/os2y3sU7QOnMFmG4RyPrqH/CQbaJxpMmwNNYOLdbMY8:7/ohZYzrG1P+zbuD8KOLdw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e71d5b926acf11e28a8a05df82b9f2d_JaffaCakes118

Files

8e71d5b926acf11e28a8a05df82b9f2d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b3d2a05aaa024c0880099a6d8ea6441

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetCurrentProcessId
InterlockedExchange
OpenProcess
GetLastError
GetModuleFileNameW
GetProcessId
CreateThread
Sleep
WaitForMultipleObjects

msvcrt

_initterm
_controlfp
_j0
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit

user32

DrawTextW
GetIconInfo
GetSysColor
GetDC
ReleaseDC

newdev

UpdateDriverForPlugAndPlayDevicesW

shlwapi

PathAppendW
UrlCombineW
PathCombineW
UrlGetPartW
UrlApplySchemeW
UrlCanonicalizeW

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ