9649c0593545393fb24ccb5b5d761a38_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9649c0593545393fb24ccb5b5d761a38_JaffaCakes118
Size

120KB
MD5

9649c0593545393fb24ccb5b5d761a38
SHA1

cca3870bedd7e620b01227fd1a65d5a3779c700e
SHA256

08b4fb83e9024181f68cf06cd294072b0e962ff13678f8cf38c46645b07b2643
SHA512

efb95cd8ef6b655f189e0c443b62db2002bd9fc5dbfaca5d39dd969b532af325bb6a25a721d2ce1de8ceae96b61708a64a8f89d066415c2937f4078ce0519d15
SSDEEP

3072:pE8vC7kCyx/6bKQWXR0UY2wTPbCGiZG+:pE8q7knk+QuiUECGH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9649c0593545393fb24ccb5b5d761a38_JaffaCakes118

Files

9649c0593545393fb24ccb5b5d761a38_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2686c8ad4c4a01f02aa8b633a611ae3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
EnterCriticalSection
ExitProcess
ExitThread
GetACP
GetCommandLineA
GetModuleHandleA
GetOEMCP
GetStartupInfoA
HeapAlloc
LeaveCriticalSection
OpenFileMappingA
RtlUnwind
SetLastError
SetUnhandledExceptionFilter
TlsGetValue
VirtualAlloc
lstrcatA
lstrcmpA

user32

EndPaint
CloseWindow
CharUpperBuffA
EqualRect

advapi32

LsaGetRemoteUserName
LsaICLookupSids
LsaLookupNames
RegEnumKeyA
RegOpenKeyExA
LsaEnumeratePrivilegesOfAccount
LsaEnumeratePrivileges
LsaEnumerateAccountRights
LsaDeleteTrustedDomain

msvbvm60

__vbaDateStr
__vbaEraseKeepData
__vbaCyUI1
__vbaCyFix
__vbaCyErrVar
__vbaCopyBytesZero
__vbaAryVarVarg
__vbaAryConstruct2

dinput

DirectInputCreateA
DirectInputCreateW
DirectInputCreateEx

Exports

Exports

Woycd
Wspkughcocw

Sections

.text
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ