a9cb3fa9e362090e3937ba95eaf06cd8_JaffaCakes118 | Triage

Sharing

General

Target

a9cb3fa9e362090e3937ba95eaf06cd8_JaffaCakes118
Size

398KB
MD5

a9cb3fa9e362090e3937ba95eaf06cd8
SHA1

3457f70c67302a3f7cc8e27b1e7c967919ef620b
SHA256

ee51df51d91daa155caf8b167d6966e65c3587347a207380b5449e1582f200f7
SHA512

ae047f1625f2f5e3dc1fab3cbb54c37b130f64fed91f9071eb19f3fc611492c54b453e77ef464d72e3406acf54bcb092e41ccc205de71bb898a4a617561fad2e
SSDEEP

12288:FkLoAM1DS3MpLxG7dwe7tUWfcMW/q3BuU:FkLPO28tG1t3w/qRu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9cb3fa9e362090e3937ba95eaf06cd8_JaffaCakes118

Files

a9cb3fa9e362090e3937ba95eaf06cd8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1f98f7e2601b49ad9f8686e45d851e63

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileW
UnmapViewOfFile
lstrlenA
LocalFree
HeapCreate
lstrcpyA
GetComputerNameA
FindResourceW
GetModuleHandleA
SetLastError
GlobalUnlock
GetCurrentThreadId
Sleep
FindClose
GetCommandLineA
GetCurrentDirectoryA
CreateProcessA
CloseHandle
PulseEvent
LoadLibraryW

user32

GetDlgItem
CheckRadioButton
DrawEdge
FillRect
DrawMenuBar
CreateWindowExA
GetCaretPos
DispatchMessageA
CallWindowProcA
SetFocus
IsWindow
GetDC
CreateIcon

cryptui

CryptUIDlgSelectStoreA
CryptUIDlgSelectCA
CryptUIDlgCertMgr
WizardFree
LocalEnroll

appwiz.cpl

ConfigStartMenu

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 396KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 371KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ