b1dc6562f425f8db74e913caed606211_JaffaCakes118 | Triage

Sharing

General

Target

b1dc6562f425f8db74e913caed606211_JaffaCakes118
Size

27KB
MD5

b1dc6562f425f8db74e913caed606211
SHA1

17c0e26c6425382e3b90699937e978f003740809
SHA256

c107dbf0404dd7a6f9e41402d37a785eb3ec5f105955639e7dfa126d1e7bbc80
SHA512

5e7f60fa841785d31e1b1e5456cb27057ac941ed0c8517f5fd2057dd127dc90e92c4e0cc2cf68bb190bba75360df6604df548ad22f836d9e816b3321c360d9d8
SSDEEP

384:KzXlZr3qrrRxY81ruPRNdXu1XdMdD7wHoBBT5RPA+gQBNBIEtgMugdYZLbeVt03P:KzXlZDqrVPInDkIL51A+ggr1Yg0Tj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1dc6562f425f8db74e913caed606211_JaffaCakes118

Files

b1dc6562f425f8db74e913caed606211_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a97f480bd6f4d2c6507000c2b8dcfb48

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
VirtualAlloc
SleepEx
MulDiv
lstrlenA
WaitForSingleObjectEx
SizeofResource
QueueUserAPC
LockResource
GetModuleHandleA
GetCommandLineA
SetLastError
LoadResource
CreateThread
ExitProcess

gdi32

GetDeviceCaps
DeleteObject
CreateCompatibleBitmap
SetBkMode
SelectObject
DeleteDC
CreatePen
CreateCompatibleDC
BitBlt

user32

LoadIconA
LoadCursorA
RegisterClassExA
PostQuitMessage
MessageBoxA
GetMessageA
EndPaint
DispatchMessageA
DefWindowProcA
BeginPaint
TranslateMessage
GetDC

shlwapi

UrlHashA

oleaut32

OleLoadPicture

ole32

CreateStreamOnHGlobal
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitialize

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 228B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ