b5f15845d8d218c54fae59283c17d5e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b5f15845d8d218c54fae59283c17d5e0_JaffaCakes118
Size

156KB
MD5

b5f15845d8d218c54fae59283c17d5e0
SHA1

e705fa7df6da09bea8e36faef53da2a9e29d0cef
SHA256

d61b6138a458994e86cb2ad128aea82c8e1d3300bcbaf783f323f09555f2d02b
SHA512

10c0879be60d61cf8d8fb2525d81955eb009fb728721cc50aa69771d3edcd201f8a29e155f12d9550dc3c42f8741659680da6e1dcad828ab875ea481edc28af0
SSDEEP

3072:iKHmj+SIIpx1Lm3Edft5jNbKuotlE+4AYDRfxJlR6k9kiOmuuIIn:uj+NIpf8Edf7jNbVeH4Zx3R4dk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5f15845d8d218c54fae59283c17d5e0_JaffaCakes118

Files

b5f15845d8d218c54fae59283c17d5e0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7caf232b1f5f3e0a21a171377a3a41e8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

lstrcpynW
lstrcpyA
GetLastError
GetCPInfo
lstrlenW
MultiByteToWideChar
CheckRemoteDebuggerPresent
DeleteCriticalSection
OutputDebugStringW
LockResource
EnumResourceTypesW
lstrcpyW
GlobalAlloc
GetTickCount
lstrcmpiW
WideCharToMultiByte
InitializeCriticalSection
GetACP
FindClose
GlobalFree
GetModuleHandleW

winspool.drv

DocumentPropertiesW

user32

GetAncestor
KillTimer
GetMessageW
PostThreadMessageW
TranslateMessage
SetTimer
wsprintfW
DispatchMessageW
CharUpperW
GetDC
CharNextW
UnregisterClassA

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isete
Size: 1024B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ