b56fb480b81e6f04633772871952900a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b56fb480b81e6f04633772871952900a_JaffaCakes118
Size

35KB
MD5

b56fb480b81e6f04633772871952900a
SHA1

7f7874e5959699fb1f28bc0a7890dd59701874be
SHA256

9af12eeade4f69467d314f568489c3e151c36bbff1a52dc5288f08e94af35fda
SHA512

6f4967e701c070f1f2ee22f42ba271207f04c64aff84530a0ba81101b1722ed47980fe3596f866367c23de572d1280a39fb33765a522364b13f8ed2709567a99
SSDEEP

768:S6zA4hZBsEcX6FPwls9d2YVyAxx0DaNdpTiAt4BHZ+:PzA4h7sJqwa9d2Y0TDaNPTt4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b56fb480b81e6f04633772871952900a_JaffaCakes118

Files

b56fb480b81e6f04633772871952900a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3e9e24392871e52ba7484f21e0afc58f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

N:\ycbLflj\dhCxoktVsFz\gxzEetcE\nmMnqnQOmAqI\hCcyJabylnis.pdb

Imports

shlwapi

ord158

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
atol
_amsg_exit
_initterm
strspn
sprintf
clearerr
_ismbblead
_XcptFilter
_exit
_cexit
__setusermatherr
__getmainargs

kernel32

GlobalLock
CreateThread
CreatePipe
GetModuleFileNameA
ExitThread
GetModuleHandleA
Sleep
LoadLibraryW

gdi32

GetTextExtentExPointW
EnumFontFamiliesExW
CreateHalftonePalette
GetNearestPaletteIndex
CreateHatchBrush
CreateEllipticRgnIndirect

user32

SetScrollInfo
SetRectEmpty
GetWindowPlacement
GetShellWindow
wsprintfA
LoadIconA
IsDialogMessageA

Exports

Exports

?CreateDlgMessage@@YGHPAXPADK|U

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE