bc06dc3649fb6729cb917b35111b4844_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bc06dc3649fb6729cb917b35111b4844_JaffaCakes118
Size

50KB
MD5

bc06dc3649fb6729cb917b35111b4844
SHA1

e533efbb3bc597a0dd9ca0632768db48ff88f6b9
SHA256

1ff17e4ee7193601f11840b3206f96522277eee184da7511a8749cc057a85a02
SHA512

a414bc4ffc9c87ad1bcb636d0eed7b5584686fc214d2f7c385516a80e3f25d5ac6823017b7f0715f4afa9d6a4b63449faabfc536390e9cb4da24bfee8919615b
SSDEEP

1536:I/nQQi4mRFHFwUUknV6cUlud5++yfJlG:AQj4mRPgLt+yfJl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc06dc3649fb6729cb917b35111b4844_JaffaCakes118

Files

bc06dc3649fb6729cb917b35111b4844_JaffaCakes118
.exe windows:4 windows x86 arch:x86

de60338bb985a67b05ddadba827f38f7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

BeginUpdateResourceA
CompareStringW
EnumResourceLanguagesA
ExitProcess
GetCommMask
GetSystemInfo
GlobalFlags
LocalReAlloc
PeekConsoleInputW
PeekNamedPipe
VirtualFree
WriteProfileStringA

advapi32

CryptDecrypt
CryptImportKey
GetCurrentHwProfileW
GetMultipleTrusteeA
InitiateSystemShutdownA
MakeSelfRelativeSD
ObjectCloseAuditAlarmW
OpenProcessToken
RegEnumKeyExA
RegisterEventSourceW
ReportEventA
StartServiceA

gdi32

CancelDC
GetEnhMetaFileW
GetWinMetaFileBits
RemoveFontResourceW
SetBkMode
SetBrushOrgEx
SetPolyFillMode
SetTextJustification

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE