a896c9cfa9bc88f8a1c7fcfab6a25e3d_JaffaCakes118 | Triage

Sharing

General

Target

a896c9cfa9bc88f8a1c7fcfab6a25e3d_JaffaCakes118
Size

115KB
MD5

a896c9cfa9bc88f8a1c7fcfab6a25e3d
SHA1

e9157e41f987ed24fc2ca4b166e8fdc6b26dfe9b
SHA256

e61e4603c6e79bd715819ad617f286ee65c4ab771e4b71d2f8c4a638bc53782c
SHA512

df9d671e1c533ed68165141a1f9b09566a629f0ec7b306f54dc6b8560ebf75f56b4f3925079656493ff702e4aab2122fd2fce46615d00e65605cc3a9ad8c1ca8
SSDEEP

3072:LwUeOVnUFEckGZTMvFvAyBDON/+nGKr3P128/8y:l1YVklvFvDBDONaPA8/8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a896c9cfa9bc88f8a1c7fcfab6a25e3d_JaffaCakes118

Files

a896c9cfa9bc88f8a1c7fcfab6a25e3d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

786c270f9bf875c3346c75a1ea619a6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

InvertRgn
PolyPatBlt
RectVisible
CreateRectRgn

msvcrt

_copysign
__p__tzname
__p__wpgmptr
_mbsnicmp
_dup
_getws
_inp

kernel32

CreateEventW
GetCommConfig
GetCurrentProcessId
GetThreadLocale
LocalAlloc
LocalHandle

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 91KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE