af3aef192cff57531d15c5c627ee15d3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af3aef192cff57531d15c5c627ee15d3_JaffaCakes118
Size

126KB
MD5

af3aef192cff57531d15c5c627ee15d3
SHA1

d687d48bdb6b7a58617bd2088512910442527937
SHA256

4c1b042d73ecb54c7a9ba10871b5605d612b8ca379c43aae7394322ab5c585cb
SHA512

dd5fb54638baaebdb3d8f8af028f3f39329f52b9c792ba295c4edf027c99fd47367dde14213e038533b3b7b0839f34eee48749541671ef53ec5db28621ae6b27
SSDEEP

3072:9ocr2/6ZforctEhjIPodKvAk7MiOy5HrXvtehZXS3zyINRZhL/Htx895:9zi/kforcS5NkNYy5HaZijNRfNx25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af3aef192cff57531d15c5c627ee15d3_JaffaCakes118

Files

af3aef192cff57531d15c5c627ee15d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2727b6553b452f481add28350383bba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FindNextFileW
GetCommandLineW
GetCurrentProcess
GetEnvironmentStrings
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathW
IsDBCSLeadByte
IsDebuggerPresent
LoadLibraryA
SetStdHandle
VirtualAlloc
VirtualFree

user32

DestroyMenu
GetKeyState
PtInRect

gdi32

CreateCompatibleDC
CreateRectRgn
UnrealizeObject

shell32

SHBrowseForFolderW
ShellExecuteW

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 765B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.erdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE