9fd8803ad0b5c99a56a192e6a0b41ca4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9fd8803ad0b5c99a56a192e6a0b41ca4_JaffaCakes118
Size

412KB
MD5

9fd8803ad0b5c99a56a192e6a0b41ca4
SHA1

b473ae7f57345e3fde9e08359756468a3a0339b8
SHA256

46ca679a47365d06c78ae62e0f11612f5859adf4073fee9d37d8a674cb1ae217
SHA512

7d10f0e13fa32fbcd8868ec092776c5e5a06ad131fdec7b3a0b12bbc30b71d91a53db1e2dff1d1532ac1f66cf1f3bba0bf99543181a875fa7db5b66df7d0d0d2
SSDEEP

6144:gFCPwAhqq6Ml1wQ8Pr7UQr8J2n5CFWNN3fCsjFIpOo/nbZj7y402GmJlt30PUV62:gMPwAaMDQr7m25CK5IsojZj3GGN0s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9fd8803ad0b5c99a56a192e6a0b41ca4_JaffaCakes118

Files

9fd8803ad0b5c99a56a192e6a0b41ca4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

463346b27cf2209638f600e005bf9d9b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
VirtualQuery
GetFileSize
TlsSetValue
RtlUnwind
lstrlenW
QueryPerformanceCounter
GetCurrentProcess
GetProcAddress
VirtualAlloc
GetCurrentThreadId
CreateRemoteThread
HeapReAlloc
HeapAlloc
lstrcpyW
EnumTimeFormatsA
HeapFree
InterlockedExchange
GetModuleFileNameA
TerminateProcess
GetModuleHandleA
ExitProcess
FreeEnvironmentStringsA
FoldStringA
GetConsoleCursorInfo
LoadLibraryA
GetTickCount
GetSystemTimeAsFileTime

gdi32

OffsetClipRgn
PtInRegion
ModifyWorldTransform
gdiPlaySpoolStream
GetNearestPaletteIndex
GetTextExtentPointA
CreatePolyPolygonRgn
DPtoLP
GetWindowOrgEx
CreateMetaFileA

comdlg32

GetSaveFileNameA
ReplaceTextA

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ