b389face833ea8e03cd134b6b3e061d3_JaffaCakes118 | Triage

Sharing

General

Target

b389face833ea8e03cd134b6b3e061d3_JaffaCakes118
Size

182KB
MD5

b389face833ea8e03cd134b6b3e061d3
SHA1

59033e2a0f173a2e523368db10139e1f4059dba6
SHA256

74cb115c00d95ad8b9d31498252638036f0117776dc81698e85e18b59d8d7bd6
SHA512

0f942c058549f20535f52489f454ccd85753968a10193a0fc00257b593ef4ef849fb46ca1924e9bc7c410352e2749045b8f20b85e922a34096c5a6ebc26fb6bb
SSDEEP

3072:YrOscJZSn/s5UiJSCtkOMP3vZpCIcArNS+h3FtqaZS8aQA50Ax8KUsZOepqoY:rqs5Ugg3vZpvrpZP4dQAy+8KUOOes

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b389face833ea8e03cd134b6b3e061d3_JaffaCakes118

Files

b389face833ea8e03cd134b6b3e061d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e49d8e51aad008e77d014d2f8eb57b69

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipCloneImage

winmm

timeGetTime
timeSetEvent

ole32

OleSave
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc

kernel32

LocalAlloc
GetModuleHandleA
SetFirmwareEnvironmentVariableW
GetLastError
LoadLibraryA
InitializeCriticalSection
GetSystemInfo
SetStdHandle
LCMapStringW
DeleteCriticalSection
EnumResourceTypesA
LocalFree
EnterCriticalSection
GetShortPathNameA
LeaveCriticalSection
GetProcAddress
LCMapStringA
GetStringTypeA

wininet

InternetOpenA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle

Sections

.text
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ