a5414d066eb14b7d18a0e6044c7000d7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a5414d066eb14b7d18a0e6044c7000d7_JaffaCakes118
Size

270KB
MD5

a5414d066eb14b7d18a0e6044c7000d7
SHA1

1972d8650f12eb601000c033c4a447c67d43c69a
SHA256

9d9e5e70946272fb5bf59306fce68e1126830f56acf49404314191c5dab74815
SHA512

ccfb29278489647f06129c37e57ac70372864ce8a81417524f31af586e343a18f1b518432a93be62a7510b6f092030f01a95cbe3fa61308e5c647c040754b718
SSDEEP

6144:W6hNANbkf9JZL+0dGMRRlLkH6KerEORTkolQsde:ZhYbkf7pF4QRlLI6rrEuTkofe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5414d066eb14b7d18a0e6044c7000d7_JaffaCakes118

Files

a5414d066eb14b7d18a0e6044c7000d7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

819bc703dea4b0a47611c5b06ff802d9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceCounter
HeapFree
HeapDestroy
TlsAlloc
HeapReAlloc
HeapCreate
VirtualFree
SetLastError
GetSystemTimeAsFileTime
VirtualAlloc
EnumSystemLanguageGroupsW
IsBadWritePtr
HeapAlloc
GetWriteWatch
GetCurrentProcessId
VirtualQuery
TlsFree

winmm

mciSendCommandA
sndPlaySoundA

user32

DestroyIcon
GetWindow
GetDlgItem
LoadImageA
SetWindowTextA
CreateWindowExA
LoadStringA
GetParent

oleacc

CreateStdAccessibleObject
AccessibleChildren

ole32

ProgIDFromCLSID
CoTaskMemFree
StringFromCLSID

msimg32

AlphaBlend
TransparentBlt

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ