ba9152dab19a55b4b9793bc1c8a0223c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ba9152dab19a55b4b9793bc1c8a0223c_JaffaCakes118
Size

12KB
MD5

ba9152dab19a55b4b9793bc1c8a0223c
SHA1

fba11a1e69c9612f28cb4e301508c19fdf362c0c
SHA256

abfe5d4df62d98e075d0fdad6f46df936fa9b98d354170749da4877b1c10bff5
SHA512

6706472cc149cfcff7be353d308f4a3acfedfe3a215e5541a8b9abe23157074483be2b65c2ea88165c9f07e9c0a9aa0e9697e7db94649a941d1f8a9c20875fd7
SSDEEP

192:i1M0rfqNo8InhjhSv3TELBnowxYosOPPE4zBBBBnzRognFEAVAksBQIcC:ihTCmhjmwSwxYossEeBBBBnzRvFBySC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba9152dab19a55b4b9793bc1c8a0223c_JaffaCakes118

Files

ba9152dab19a55b4b9793bc1c8a0223c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

818f1fbcebdb7a5abf3dc7abeb6af66a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

U:\develop\local\current\Release\bin\acad\Express\LspSurf.pdb

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
lstrlenW
lstrcpyW
HeapFree
lstrcpynW
GetFullPathNameW
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
WideCharToMultiByte
GetEnvironmentVariableW
GetVersion
lstrcmpiW
FreeLibrary
LoadLibraryW

user32

wsprintfW
MessageBoxA

Sections

.text
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 116B - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE