b37e9fef8cef825d8e73f8dfb050a6ea_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b37e9fef8cef825d8e73f8dfb050a6ea_JaffaCakes118
Size

67KB
MD5

b37e9fef8cef825d8e73f8dfb050a6ea
SHA1

a222d624d53bbe59b2594feeecd90f9c89c184b6
SHA256

2e6d41a1279f7f46964f76bfacb2692c32a7c37a8bd31430f8725e5489fb02cb
SHA512

67afac13c323ee0abcc04b44735c4f0e0a9a5cefad44706b5f01f49342f2bdc37b94736b86d709516d622b75a6aa8d0bfc672ab78f1807e3f771df704d567527
SSDEEP

1536:EqZTljpCM6T5Rgu7GnOpnh0/gfHGfTp4k:ZxpCnRgT4h0GmfT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b37e9fef8cef825d8e73f8dfb050a6ea_JaffaCakes118

Files

b37e9fef8cef825d8e73f8dfb050a6ea_JaffaCakes118
.exe windows:5 windows x86 arch:x86

34e71a539d97a5cfd91c92e4e350826f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ntohl

shlwapi

wvnsprintfA

kernel32

DeleteFileA
GetModuleFileNameA
lstrcmpW
lstrcpyW
lstrcpyA
lstrlenW
lstrlenA
WriteProfileStringW
GetProcAddress
LoadLibraryW
HeapFree
GetProcessHeap
lstrcatA
MultiByteToWideChar
HeapAlloc
FreeLibrary
LoadLibraryExA
lstrcmpiA
WriteProfileStringA
WriteProfileSectionA
CloseHandle
GetLastError
CreateEventA
WriteProfileSectionW

user32

CharNextA
CharLowerBuffW
CharLowerA
CharNextW
CharNextExA
CallNextHookEx
CallWindowProcA
CharLowerBuffA

ole32

CLSIDFromProgID

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE