b6f93ba0451cccb9d88be7e028ded4fe_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b6f93ba0451cccb9d88be7e028ded4fe_JaffaCakes118
Size

1.8MB
MD5

b6f93ba0451cccb9d88be7e028ded4fe
SHA1

fc8910bf7aaa9150e538996efe1f3d4b4aa12c08
SHA256

86a65a529187b49f32aeb43d18f41030deb3239191e26cd6f97e247236922850
SHA512

161463cf72bd207db5e01f0448a3ba5f1c09c7d35f31bb50c4e99e2aebbc1c564b1e352b8cb47660495ddf9a2bc1214184a2bdfdfbf7ca9a22d65eb5d38035ef
SSDEEP

49152:jrV2lQmGPkzyzJZCbikhBGoUyJgugsqrPatfp5o/jfHHDp+nz:RhTE7BGoUyJ+sygojHH8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b6f93ba0451cccb9d88be7e028ded4fe_JaffaCakes118

Files

b6f93ba0451cccb9d88be7e028ded4fe_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d9acb6c192afdeb2ee1b8bc48f54b733

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

SetRect

gdi32

BitBlt

advapi32

FreeSid

shell32

SHGetFileInfoA

msvcrt

exit

shlwapi

SHDeleteKeyA

ws2_32

getpeername

msvcp60

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wtsapi32

WTSFreeMemory

userenv

CreateEnvironmentBlock

msvfw32

ICSendMessage

psapi

EnumProcessModules

Sections

.MPRESS1
Size: 1.8MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE