c859ec69e2838d13c12a226d62ca89f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c859ec69e2838d13c12a226d62ca89f9_JaffaCakes118
Size

66KB
MD5

c859ec69e2838d13c12a226d62ca89f9
SHA1

0107080d292be3e752cb75f1b8d0f7967ed6d3d4
SHA256

ab354cb4f26a39cb16954b332fe251fc34e3a6c91292afee803194a441954a15
SHA512

2d3eb05a53b084ac7d9c1b2e2a4e0af74fb43c195778826d5bef1fdc1098808ae95cc4a9e6a1bf9242b6d97f7d6a2b44330af82fadef829493802a8d182a7a7f
SSDEEP

1536:atu1Yketx6anuPXzd1118Wang1GUwNwhOLa7AA3n9:aDtHuPB1D8WJ4dSR9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c859ec69e2838d13c12a226d62ca89f9_JaffaCakes118

Files

c859ec69e2838d13c12a226d62ca89f9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c8d2d9f672786803dcd611ea74090ebd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

InvertRgn
PolyPatBlt
RectVisible
CreateRectRgn

msvcrt

__p__wpgmptr
_copysign
__p__tzname
_mbsnicmp
_dup
_getws
_inp

kernel32

GetCurrentProcessId
GetThreadLocale
CreateEventW
GetCommConfig
LocalAlloc
LocalHandle

Sections

.text
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE