b87dea722c5443dfcab83127e3bbc95c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b87dea722c5443dfcab83127e3bbc95c_JaffaCakes118
Size

123KB
MD5

b87dea722c5443dfcab83127e3bbc95c
SHA1

416a754a6970b32f02964950fa9bc8cf36b67e9b
SHA256

d878a339be94660a68808ed3d9863c80b7a53b6d37dd25d85c2330d0aaabefba
SHA512

d5f5cc8b6e57167578096231523e06c6b6929fef8d381e0ff0ad9d93706cc267041a027129a01b533623f8a4cc83c78987e0ea6a967b92825aca55dce318cfb8
SSDEEP

3072:kzmEvZ89UXNUuwXFVpkI3cr3WBPW77hi7dpStrj:wbZ8oyFVnS36Px7dpStv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b87dea722c5443dfcab83127e3bbc95c_JaffaCakes118

Files

b87dea722c5443dfcab83127e3bbc95c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f072c28ca5a10d7f10c7d2e9987b561

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
ClearCommError
CreateProcessW
ExitProcess
ClearCommError
ReleaseMutex
EnumResourceNamesW
CreateFileMappingA
ExitProcess
CreateMutexA
GetStartupInfoA
MapViewOfFile
QueryPerformanceCounter
GetModuleFileNameW

user32

CharNextA
GetMessageA
CharUpperA
SetTimer
PostThreadMessageA
PeekMessageA
KillTimer
LoadStringA

shlwapi

PathFindExtensionA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ