c8463e2b33c99dd64aeac75bd62baa5a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c8463e2b33c99dd64aeac75bd62baa5a_JaffaCakes118
Size

123KB
MD5

c8463e2b33c99dd64aeac75bd62baa5a
SHA1

79e16e897619d6cab42e6fbd948e876f916d9df8
SHA256

18eeb4497144f7d4d71828a16ffe92d6fca727bf84930e55d5f307461b2ad7ec
SHA512

589f9e9b882a2c270bfd46140d62e6d4bd561b6ace7cf5e5addcb32f582f341d710fd75c567e9662f613e82e1b6ec9c6d6702be7edf21ff8bee41a67fa744764
SSDEEP

3072:kzmEvZ89UXNUuwXFVpkI3cr3WBPW77hi7dpStrx:wbZ8oyFVnS36Px7dpStd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8463e2b33c99dd64aeac75bd62baa5a_JaffaCakes118

Files

c8463e2b33c99dd64aeac75bd62baa5a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f072c28ca5a10d7f10c7d2e9987b561

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
ClearCommError
CreateProcessW
ExitProcess
ClearCommError
ReleaseMutex
EnumResourceNamesW
CreateFileMappingA
ExitProcess
CreateMutexA
GetStartupInfoA
MapViewOfFile
QueryPerformanceCounter
GetModuleFileNameW

user32

CharNextA
GetMessageA
CharUpperA
SetTimer
PostThreadMessageA
PeekMessageA
KillTimer
LoadStringA

shlwapi

PathFindExtensionA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ