a9c9b542c666c32747af75b0b50cc007_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9c9b542c666c32747af75b0b50cc007_JaffaCakes118
Size

156KB
MD5

a9c9b542c666c32747af75b0b50cc007
SHA1

1ced97fc8f9df5d00b40c95dd672e3f46609ca66
SHA256

ad8a7fcd693ff2cf2c819f0a1e791db0a6dc51f5b5bba83be7500c2f79761b81
SHA512

cf2613a4a9f8f8344e59e3bd7e3eed689324d038f86bae0a375d3514332ffc02d6e13c658353eb9edd4673dcbb28b19d5709ab5c6e7856c2525b6783d2e44862
SSDEEP

3072:qXzyt5cN6Akc3MaQ+13x7zX2NHhwDWVQvAXVPhBB5ySmCQBXDp8Au:qXzySz/MaQ+1JX21q1vkBQTc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9c9b542c666c32747af75b0b50cc007_JaffaCakes118

Files

a9c9b542c666c32747af75b0b50cc007_JaffaCakes118
.exe windows:5 windows x86 arch:x86

137a9b4a6059d8b53e3c9d8dbb713fc9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Q:\XXVZzlrzSWe\qlsegYgken\dDZlgtNbr.pdb

Imports

gdi32

CreateRectRgn
GetRgnBox

kernel32

CreateFileMappingW
GlobalMemoryStatusEx
GetModuleFileNameW
GetComputerNameA
EnumResourceNamesW
VirtualProtect
CloseHandle

user32

SetWindowTextW
MonitorFromPoint
DefWindowProcA
GetUpdateRgn
TranslateAcceleratorA
SetMenuDefaultItem
TrackPopupMenuEx
WaitForInputIdle
SetFocus
AdjustWindowRect
EnableMenuItem
IsWindowEnabled
CopyRect
SetRectEmpty
FindWindowExA

ntdll

RtlCompareMemory

Exports

Exports

?TemporaryArrayCre

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE