aebb240341a641b1d8fbe95f3b42b865_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aebb240341a641b1d8fbe95f3b42b865_JaffaCakes118
Size

219KB
MD5

aebb240341a641b1d8fbe95f3b42b865
SHA1

fb69945282994d3f4c4e724d752582615a7607d8
SHA256

6ba772271fa72723856272d12649e29e74f57d4b7483ea3f72504ea628bd437b
SHA512

77e2d06af26b3850933c55ffa5453192227eb8c2363bcf638d60cf92a5781990c9569433b67d9a1027283d4d00b1742ee556a83badf854cf16761d32138b6fd4
SSDEEP

3072:RbOtA5JVAjoJf6ZPWPQpuiVBs9Yl7Pa9dV4LeAPhCPbp7q/fYkU/DcrMqQS:RbhJzJ+WopJsGteAwdyfULcYq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aebb240341a641b1d8fbe95f3b42b865_JaffaCakes118

Files

aebb240341a641b1d8fbe95f3b42b865_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1105e78c447f4df7a8dc905e73907e91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemTime
GetCurrentThreadId
GetModuleFileNameW
TlsAlloc
CreateEventA
GetCurrentProcess
InterlockedIncrement
GetCurrentProcessId
GetVersionExA
GetModuleFileNameA
InterlockedDecrement
GetStdHandle
GetCurrentThread
GetLocalTime
CreateMutexA
GetProcAddress
GetModuleHandleW
GetCurrentDirectoryA
GetModuleHandleA
GetStartupInfoA

shlwapi

PathCompactPathExW

scarddlg

ord2

msvcrt

_adjust_fdiv
__dllonexit
memcpy
memset
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_controlfp
__p__commode
__p__fmode
__set_app_type
_except_handler3
_onexit

Sections

.text
Size: 213KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ