cf84d3159e5f8db53c5a2e83dfd3042e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

cf84d3159e5f8db53c5a2e83dfd3042e_JaffaCakes118
Size

191KB
MD5

cf84d3159e5f8db53c5a2e83dfd3042e
SHA1

22ba3e302f746641ae805dc0c2261216e21257a1
SHA256

2731ed6658425e19abe101767e7ade6ae753f1c1eba5c4d028ef8d65ebd58a7a
SHA512

61246f0cee9e174f1b61a8ae214847e8023045849ce6f9b73f22d7b21dc27d2c06c236bc0a87b35687f33c22004398d1625ddd2fbeff15b875a02df06c258d6f
SSDEEP

3072:S6jK7w3ZO17Wgg4a5Nepin2XE6IiEnJUs69VEhlByU24CsQj:S6p3Z46F5WA2QUpVy4rp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf84d3159e5f8db53c5a2e83dfd3042e_JaffaCakes118

Files

cf84d3159e5f8db53c5a2e83dfd3042e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9e5594bfd34dcdc0f5a77bc10c3b836b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetProcessPriorityBoost
Sleep
GlobalAlloc
InterlockedIncrement
GlobalLock
ReadFile
CreateFileW
CreateEventW
EnumResourceTypesA
InterlockedDecrement
CreateProcessW
GetModuleHandleW
DeleteCriticalSection
WriteFile
GetModuleFileNameW
TerminateThread
GlobalUnlock

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

imm32

ImmAssociateContext

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ