b41172beca0b6e7b973fd659fb24e116_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b41172beca0b6e7b973fd659fb24e116_JaffaCakes118
Size

374KB
MD5

b41172beca0b6e7b973fd659fb24e116
SHA1

83211a4cd9a48c8c18e0d30a63f62489de46200f
SHA256

02f1a310ef377ff288a2e59e7c351387c083c232afce22b30726412e05b3b377
SHA512

0286375246e7404c9ca9723fcae6b01bd47b39e12e1b3088d871c9722e62a9302bec6bb68238f5efe7b5dd57278143efbc339f046085933bc4cd1cc6afcebf19
SSDEEP

6144:djRM59KP9EoxGcTYNh91DQJ7w6Mcx8MYeWKnEWYzXTz+VNypJOVglH5fDsf1KpXE:xRM5LL9/u5Wcxr8/frTzcNS0G3fDsf1D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b41172beca0b6e7b973fd659fb24e116_JaffaCakes118

Files

b41172beca0b6e7b973fd659fb24e116_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e8500448d5c76022392e567a2c330bb5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetNumberFormatA
FindClose
GetEnvironmentVariableW
LocalFlags
InitializeCriticalSection
GetDriveTypeW
ReadFile
TlsGetValue
lstrlenW
GetPrivateProfileStringA
LocalFree
HeapCreate
GetCurrentProcessId
SuspendThread
GetCurrentThreadId
CreateEventW
GetConsoleAliasA
LoadLibraryW
ResumeThread
FindAtomA

user32

GetClientRect
DrawStateW
DrawTextA
DispatchMessageA
GetSysColor
SetFocus
CreateWindowExA
EndDialog
IsWindow
GetClassInfoA
GetSysColor
CallWindowProcW
GetKeyboardType

srclient

EnableSR
EnableSR
EnableSR
EnableSR
EnableSR

clbcatq

DllGetClassObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 364KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ