a9389467f34bec9bb9bd99a5f856654d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9389467f34bec9bb9bd99a5f856654d_JaffaCakes118
Size

327KB
MD5

a9389467f34bec9bb9bd99a5f856654d
SHA1

8529155558adfcb23f96a4ba51ed3585ab1a1fc6
SHA256

efc2006d73629f3c7d59d6caf7b0d13b83de605697cdc668b5ba0e4fa7287de8
SHA512

12174eff37b9b0675fc8f841e182e231bab5891ffdfd834d5893d52c1ae1bf4c1fa106bac6fb1e5f4d9544e7a7c0ad0dd024a8c0e816fbcb0cbe29cc81554c9b
SSDEEP

6144:YxFs0TjvRTU+ArBB3rnzPApesHB9m2PbIdOfFrdPORYkptL/BVsh/ddBTBLQ2:Yv1jvlUjB7zPIPrbIdOtrdGRXptL/BSF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9389467f34bec9bb9bd99a5f856654d_JaffaCakes118

Files

a9389467f34bec9bb9bd99a5f856654d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

760d1f8205ace334fc46cf65edd1f20f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

shell32

CommandLineToArgvW

wintrust

WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WinVerifyTrust
WTHelperProvDataFromStateData

user32

SystemParametersInfoA
GetWindowWord
EnumChildWindows
FindWindowExA

ole32

CoTaskMemFree

kernel32

GetComputerNameW
FindFirstFileA
ClearCommError
FindNextFileA
ExitProcess
DeleteFileA
GetWindowsDirectoryA
FindClose

gdi32

CreateBitmap
CreateCompatibleDC
DeleteObject
GetDeviceCaps
SetBitmapBits
GetObjectW
SelectObject

setupapi

SetupGetTargetPathW
SetupIterateCabinetW

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ