baad0ba5161883106ab153da0bcfc783_JaffaCakes118 | Triage

Sharing

General

Target

baad0ba5161883106ab153da0bcfc783_JaffaCakes118
Size

283KB
MD5

baad0ba5161883106ab153da0bcfc783
SHA1

59c4280a4e71204a42d67cf52da6055d17d29cee
SHA256

84e2262def66c581cfc3d98c96578e4536e878a64e7d1cf74c7ad3b390ed378d
SHA512

3117be8cb54a683c4c40ed453c4dd2cb903066876c0813a11b305d9aadf29c324709512873007f2c08885b38422f67b7a970c0d6047631b1cbae0e55c4dd4390
SSDEEP

6144:XGnRvoAIBjgHA+et3Bwqg555DoygfXia9a/6CNHy5rR:XGn2AIBs5etxU5M1hSNHu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
baad0ba5161883106ab153da0bcfc783_JaffaCakes118

Files

baad0ba5161883106ab153da0bcfc783_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0006388335d76c25e9f6e737dbb6c03a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

EnumWindows
GetWindowThreadProcessId
GetWindowTextA
IsWindowVisible
wsprintfW
wsprintfA

kernel32

SizeofResource
GetProcessHeap
GetProcAddress
EnumResourceLanguagesA
GlobalAddAtomW
LoadResource
FindNextFileW
SetLastError
HeapAlloc
FindResourceExA
EnumResourceNamesA
MultiByteToWideChar
EnumResourceNamesA
InterlockedExchange
FindFirstFileA
FormatMessageA
HeapFree
GetModuleHandleA
EnumResourceTypesA
GetCurrentDirectoryA
LoadLibraryW
CloseHandle
RaiseException
GetCurrencyFormatA
LocalFree
GlobalFree
FindFirstFileW
LockResource
GetLastError
GetCommandLineA
Sleep

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyA
CM_Get_DevNode_Status

Sections

.text
Size: 150KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ