b93a5cf8fb87f4279969c385f1258fe6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b93a5cf8fb87f4279969c385f1258fe6_JaffaCakes118
Size

176KB
MD5

b93a5cf8fb87f4279969c385f1258fe6
SHA1

6d2108fd380b592a868a678527188254e384ee7d
SHA256

90c512513ce99864c264de586f21e025b7349835f82b9f89cbc4a0f86e260bf2
SHA512

604bae61406c3e6022092673d1f6e81105221c80b34eb396698771eda55c1f3026b34c2c2c8660e4124ca96959bfb25094dfe41e55ab5b37b152b4c83e1b5c2b
SSDEEP

3072:OMEkbJqKLsAu9RDdQb1/JDj0nGt7XI9luYSFEHRlfxEOgC:OIbBsp/p05j0nGQlnSK3fqOgC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b93a5cf8fb87f4279969c385f1258fe6_JaffaCakes118

Files

b93a5cf8fb87f4279969c385f1258fe6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d1aac0aa7e4c29b4a7718b2f4014330

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

clusapi

CloseCluster

kernel32

GetLongPathNameW
InterlockedIncrement
GetProcAddress
GetWindowsDirectoryA
SetThreadContext
MultiByteToWideChar
LoadLibraryA
DeleteCriticalSection
GetModuleFileNameA
GetVersion
EnumResourceNamesA
DisableThreadLibraryCalls
GetFileAttributesA
ExitProcess
InitializeCriticalSection
InterlockedDecrement
lstrcpynA
GetLocaleInfoA

user32

EndPaint
OffsetRect
GetWindowRect
GetDC
ReleaseDC
BeginPaint
SetDlgItemTextA
DestroyWindow
SetFocus
GetKeyState
MoveWindow
PtInRect
LoadAcceleratorsA
EqualRect
SetWindowRgn
GetActiveWindow
SetWindowLongA
CharNextA
IntersectRect
DefWindowProcA
GetDlgItem
UnregisterClassA
SetParent

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ