8e94ca5eb56a64f43d5d55c9f7f0dadf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e94ca5eb56a64f43d5d55c9f7f0dadf_JaffaCakes118
Size

187KB
MD5

8e94ca5eb56a64f43d5d55c9f7f0dadf
SHA1

fc9afa45b6853cdb6385e7089c0f994ffb97a2aa
SHA256

78d3d571ecb4c1c93a24c0609becba8ccb72e3662e0b19cfb08cc488029294ce
SHA512

c98f25fc5857dbbde18937ab7142fd6f947c1238decd8defb7e160174761eee5f30bb9b99048276020b3a47e83f0386b62d3f4ccd275b4708e746d1addf69899
SSDEEP

3072:ge2F8bVk6Q+Bvft7SYZxcrk2UgnnkNOm0urQr1X8OuMStIbQv:H2KxQ+VZD2PXnnm0urQhX8OiaI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e94ca5eb56a64f43d5d55c9f7f0dadf_JaffaCakes118

Files

8e94ca5eb56a64f43d5d55c9f7f0dadf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

051f5433fce77d29a17e83ddc935dfe9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetEnvironmentVariableW
ExitProcess
MapViewOfFile
CreateFileW
AddAtomW
CreateFileMappingA
GetProcessHeap
WriteConsoleW
TlsAlloc
GetModuleHandleA
GetConsoleCP
GetTempPathW
GetVersionExW
GetProcAddress
EnumResourceNamesA
TlsSetValue
HeapFree
SetLastError
UnmapViewOfFile
GetVersionExA
CreateFileA
HeapAlloc
IsBadStringPtrW
InterlockedIncrement
GetConsoleMode
GetModuleHandleW
TlsGetValue
GetLastError
FlushFileBuffers
TlsFree
InterlockedDecrement
LoadLibraryExW
Sleep

shlwapi

PathAddBackslashW

winmm

mciSendCommandW
sndPlaySoundW

setupapi

CM_Get_Depth_Ex
SetupDiGetDeviceRegistryPropertyA
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ