a1bf21f747b786aebcd7989dd4110cca_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1bf21f747b786aebcd7989dd4110cca_JaffaCakes118
Size

128KB
MD5

a1bf21f747b786aebcd7989dd4110cca
SHA1

d8c7373fbf11f94225f85d2083fc1278cf71d300
SHA256

8e295ceedf7650ac52bbeac8e31ff517c7b07dd3e701afcee46dd1cf4603f900
SHA512

bbfaa6172fd77f0cfe042bcc27ab4b6b1070774f7c8873d99c5bad07dd3b6b6e7b614eddbdd5a8c1d1abc64972045b7843ccfe2d7ef12e0384f01540f315d9c6
SSDEEP

1536:MzOU/Y56pVnlg1ULsmZQmda1dxk2AHnkoLWiWNYMZetm0QPof07:MyO9pVgIxdCXxAHM5NYPM0QPof07

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1bf21f747b786aebcd7989dd4110cca_JaffaCakes118

Files

a1bf21f747b786aebcd7989dd4110cca_JaffaCakes118
.exe windows:4 windows x86 arch:x86

093a9d24b6665b2fd0c752e50f11d555

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
GetDriveTypeW
IsBadReadPtr
DeleteCriticalSection
SetLastError
TlsGetValue
VirtualProtect
GetDateFormatA
EnumResourceTypesA
Sleep
GetDiskFreeSpaceExW
GetModuleHandleA
CloseHandle
IsBadCodePtr
FreeConsole
GetLastError
LoadLibraryExA
PulseEvent
FindClose
GetCommandLineA

shell32

DuplicateIcon
DragQueryFileA
ExtractIconA
DragFinish
DllUnregisterServer
StrChrA
SHGetMalloc
DragAcceptFiles
ShellMessageBoxA
ShellAboutA
SHFree
SHGetSettings
SHGetDiskFreeSpaceA

printui

vQueueCreate
vPrinterPropPages
bFolderGetPrinter
bPrinterSetup
PnPInterface

advapi32

RegCloseKey

Sections

.text
Size: 1024B - Virtual size: 652B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ