b22968569e5842c94a794144ce2f1066_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b22968569e5842c94a794144ce2f1066_JaffaCakes118
Size

123KB
MD5

b22968569e5842c94a794144ce2f1066
SHA1

4092d06aa8a13b06ee9f75ded688c88a76475e04
SHA256

15b08c696ecab881d2caabd02198d33f71c872773c3774cb08a2f8b73ba02eb2
SHA512

57f42ecfc9425f3fd240b167fb55eb3e29e7832788bf426d2657a626f7bcd2087e469605d8722d772bb76f2393355c6fe953c25c1c90bd748915019a8848ec58
SSDEEP

3072:kzmEvZ89UXNUuwXFVpkI3cr3WBPW77hi7dpStrR:wbZ8oyFVnS36Px7dpSt1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b22968569e5842c94a794144ce2f1066_JaffaCakes118

Files

b22968569e5842c94a794144ce2f1066_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f072c28ca5a10d7f10c7d2e9987b561

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
ClearCommError
CreateProcessW
ExitProcess
ClearCommError
ReleaseMutex
EnumResourceNamesW
CreateFileMappingA
ExitProcess
CreateMutexA
GetStartupInfoA
MapViewOfFile
QueryPerformanceCounter
GetModuleFileNameW

user32

CharNextA
GetMessageA
CharUpperA
SetTimer
PostThreadMessageA
PeekMessageA
KillTimer
LoadStringA

shlwapi

PathFindExtensionA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ