ba63eae99916d2ec2197854160ded16c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ba63eae99916d2ec2197854160ded16c_JaffaCakes118
Size

173KB
MD5

ba63eae99916d2ec2197854160ded16c
SHA1

2e4c7accd5195010933c956886242516169cd129
SHA256

187d87c800f362ced60035dca631e0dcd1a2baad1da06cb0ed9b2d2509dfa504
SHA512

173a18135a5edb3eb3357f03e318f4f02ddb07001a47c8081d5fd8044936851a94065291e52eb2dbbb06fe775d15124d472d794196e4d2368639ef61fd5838dc
SSDEEP

3072:0iwiXauqH2ZyT5nPGBfoh0eGgM0YZmtrijKB5onK:0zuFwT5n+xiy8th5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba63eae99916d2ec2197854160ded16c_JaffaCakes118

Files

ba63eae99916d2ec2197854160ded16c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ce9b5ae6a93d25f36a033c4dc89d319b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

LresultFromObject

user32

GetUpdateRgn
GetWindowInfo
CreateWindowExW
EndDialog

kernel32

PrivCopyFileExW
CreateFileMappingA
GetProcessId
DeleteAtom
EnumResourceTypesA
ExitProcess
AddAtomW
MapViewOfFile
ProcessIdToSessionId

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ