9ff49bd83229735f5e246a174aff1827_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9ff49bd83229735f5e246a174aff1827_JaffaCakes118
Size

202KB
MD5

9ff49bd83229735f5e246a174aff1827
SHA1

13cc25b5e35b0f6172aada79e4d136eb54d41593
SHA256

f8322c600577c6291a374ed4edc4d13db194b937f444c12b1f3682d33a81b0dd
SHA512

d9d04dbb89c7997cdd3a76b6a72b0efdbbb8f1c37d7ba1180db09f4f2e1278ac234d909f47b4ce43865d7292928654e9914eddc9ec822b09a59441dd3c62f61f
SSDEEP

6144:XzVAcc8H+MxFcMo2qgON+QF65FNgmiqXMASWfX49:XzVM8H+GFcMF6+M65ckSEXC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ff49bd83229735f5e246a174aff1827_JaffaCakes118

Files

9ff49bd83229735f5e246a174aff1827_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9b54103e44935181ab251ceda2797f8c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
TerminateProcess
QueryPerformanceCounter
GetModuleFileNameA
GetProcAddress
VirtualAlloc
HeapReAlloc
LoadLibraryA
VirtualQuery
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapAlloc
GetTickCount
GetCurrentThreadId
GetCurrentProcess
GetModuleHandleA
GetSystemDirectoryW
RtlUnwind
ExitProcess
InterlockedExchange

shell32

RealShellExecuteExW
ShellAboutA
ExtractAssociatedIconA
SHGetFileInfo
SHGetFileInfoA
SheChangeDirExW
ShellAboutW
SHGetPathFromIDListW
ExtractAssociatedIconExW
DragQueryFileA
FindExecutableW
SHGetDiskFreeSpaceA
SHAddToRecentDocs

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ