ce41466241ec03fdbbb3406a965775f8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce41466241ec03fdbbb3406a965775f8_JaffaCakes118
Size

189KB
MD5

ce41466241ec03fdbbb3406a965775f8
SHA1

800299a94e4c799b234531aa7ca23f729be50b2d
SHA256

e5e4c144e4adbf69d77888b1ff4822da1d8f5c39b79710592d2bc6692664f7f9
SHA512

d1965ca2d6f4016b3c2266c1c4bb64e42e57f8a371fc3280e2f4792beebbde8ed4133f96d73af86b6f8430a695232b9a477db3f44c7a9b95a470c80edd7e6655
SSDEEP

3072:iGY0EASIx9CslDkMgQ8XGT7Nl8iv9mCYz6a0PkhnxK0:iGY0EdIx9pDlgQGGT7NlFUzuPkhx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce41466241ec03fdbbb3406a965775f8_JaffaCakes118

Files

ce41466241ec03fdbbb3406a965775f8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5bbd8885e2c0394d995070058a980add

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoGetMalloc
StringFromGUID2
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree

gdiplus

GdipGetImageWidth
GdipDisposeImage

kernel32

GetCalendarInfoW
CreateDirectoryW
GetCurrentDirectoryW
ExitProcess
VirtualQuery
GetModuleHandleW
WideCharToMultiByte
GetFileInformationByHandle
GetProcAddress
SearchPathW
GetFileAttributesW
OutputDebugStringA
DuplicateHandle
SetLastError
VirtualProtect
EnumResourceNamesA
GetCurrentThreadId
lstrlenW
SetEnvironmentVariableW
OutputDebugStringW
lstrcmpiW
InitializeCriticalSection
LocalAlloc
InterlockedExchange
GetModuleFileNameW
GetProcessId
GetCurrentProcess
LocalFree
GetLastError
FreeLibrary
GetModuleHandleA
MultiByteToWideChar
Sleep

Sections

.text
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ