bfbe9a41ec781d8434c166a356db3921_JaffaCakes118 | Triage

Sharing

General

Target

bfbe9a41ec781d8434c166a356db3921_JaffaCakes118
Size

64KB
MD5

bfbe9a41ec781d8434c166a356db3921
SHA1

19693f718839b7ea8898848516cca999bc60cf25
SHA256

b5810e4215f3bd19827e8ebf92fd6dcf7443f0c1ddd3fb1c30f3644cc69d7bc0
SHA512

4893417fe80666e337d9c1342711f65c25f42c3a806543569ed502a9e919b93ee61a71bb634bf700c99f58438e378aa0f97b6ea8426bd2da55b7ce62dd3a351d
SSDEEP

1536:cJaA4RY7Yd7P0JfMwlFFFc02ZjiIbgaq29O/:2aA4y7YdoJXFzCbq2Y/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bfbe9a41ec781d8434c166a356db3921_JaffaCakes118

Files

bfbe9a41ec781d8434c166a356db3921_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8b850e5069a43991d5a270f1c1f5ee39

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ulib

?Strlwr@WSTRING@@QAEPAV1@KK@Z
?Resize@DSTRING@@UAEEK@Z
??_7WSTRING@@6B@
??9WSTRING@@QBEEABV0@@Z
?IsSuppressedMessage@MESSAGE@@UAEEXZ
??_7DSTRING@@6B@
??0CLASS_DESCRIPTOR@@QAE@XZ
?DumpDataToLog@MESSAGE@@QAEEPAXK@Z
?Strspn@WSTRING@@QBEKPBV1@K@Z
?Strcspn@WSTRING@@QBEKPBV1@K@Z
??0CHKDSK_MESSAGE@@QAE@XZ
?ResetConversions@WSTRING@@SGXXZ

ole32

CoGetMarshalSizeMax
OleLockRunning
OleIsRunning
CoGetStandardMarshal
CoUnmarshalInterface
OleCreateMenuDescriptor
OleCreateLink
OleRegGetUserType
CoRevokeMallocSpy
CoGetStdMarshalEx
CoReleaseMarshalData
OleCreateFromDataEx

ntdll

RtlMoveMemory
RtlNtStatusToDosError
RtlPrefixString
RtlTimeFieldsToTime
ZwSetSecurityObject
RtlTraceDatabaseAdd
LdrInitializeThunk
RtlSetAllBits
RtlSetUserValueHeap
ZwRaiseHardError
ZwSetSystemPowerState
RtlConvertSidToUnicodeString

Sections

.text
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE