abf35b8199d8e1a1468ed569225a83c5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

abf35b8199d8e1a1468ed569225a83c5_JaffaCakes118
Size

344KB
MD5

abf35b8199d8e1a1468ed569225a83c5
SHA1

1a61d7ece1a2b74afa759f20b5b22efd25baeab2
SHA256

9adc65e0492f3c7a285cab6cf5dd6e68fba3493de9a1368101b393a7043e89fe
SHA512

69fd1e3ed1c577d45e8b1c126efd417d40a2f6ba85fb905400da9401db5199131c06cc2841dfd05e144c49b3a4e0d496a8bde2bfc469835d31f9249cf4b24c5c
SSDEEP

6144:3G/w7kmE22r5niRShmYYj9NP4BK8sVg3sB7eGORukzBcgcAiZpyao:3kmX2dhmYaKXsVg3Y7eGOR1Sgcy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abf35b8199d8e1a1468ed569225a83c5_JaffaCakes118

Files

abf35b8199d8e1a1468ed569225a83c5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

99a5a3b981f188e7a99da25c4e765e43

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryValueExA

kernel32

HeapFree

shlwapi

PathFileExistsW
PathRemoveFileSpecW
StrCmpNIA
StrCmpNIW
wnsprintfA
wnsprintfW
wvnsprintfW

user32

CloseWindowStation
DispatchMessageA
DrawIcon
GetIconInfo
GetKeyState
GetMessageA
GetWindowThreadProcessId
LoadCursorA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
ToUnicode

Sections

.mpuvgb
Size: 42KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lod
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ziz
Size: 6KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ