b7372665bd97b90c08f66d46b1414837_JaffaCakes118 | Triage

Sharing

General

Target

b7372665bd97b90c08f66d46b1414837_JaffaCakes118
Size

123KB
MD5

b7372665bd97b90c08f66d46b1414837
SHA1

4e4bc477360309b16b4aa1a29f6a1da25ea76962
SHA256

d0c38c67aafd1e9e08aa828a1d409a38cd384daa12406d85535063dcdaa8445a
SHA512

8039a5e379d1a1b49760026ec6beb58d7131b156c62764e4ffac703fd229b65028f8ba4f5336ef7cfba05da428a0df978716a59987d476f448d39f7b7a00b4b4
SSDEEP

3072:kzmEvZ89UXNUuwXFVpkI3cr3WBPW77hi7dpStrY:wbZ8oyFVnS36Px7dpSts

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7372665bd97b90c08f66d46b1414837_JaffaCakes118

Files

b7372665bd97b90c08f66d46b1414837_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f072c28ca5a10d7f10c7d2e9987b561

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
ClearCommError
CreateProcessW
ExitProcess
ClearCommError
ReleaseMutex
EnumResourceNamesW
CreateFileMappingA
ExitProcess
CreateMutexA
GetStartupInfoA
MapViewOfFile
QueryPerformanceCounter
GetModuleFileNameW

user32

CharNextA
GetMessageA
CharUpperA
SetTimer
PostThreadMessageA
PeekMessageA
KillTimer
LoadStringA

shlwapi

PathFindExtensionA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ