d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118 | Triage

Sharing

General

Target

d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118
Size

272KB
MD5

d068b3fe41ac9d98cd3a29d3bb4883a5
SHA1

c045143d113e295b6765f364fd5c468e5086369e
SHA256

04615bb86170e97f549f956cae47e06954c618207c4bc0189a18b0eb95127838
SHA512

4a2f1a4366b9250b66f704bdfc0280b2a10a1eb1b06ae579338df49c7ac07a527a2d6931da791586876a34dafd63a771082701f3a06052fac826bd5781911e05
SSDEEP

6144:K3yLcxK+CXab720WKQVCAU4HbC2iiajmS7crmaY:KCqcG20WKopHNhpxL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118

Files

d068b3fe41ac9d98cd3a29d3bb4883a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2871f4aafa7cedbcb30da96488fa16cf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SendMessageA
EnumChildWindows
CreateWindowExW
DestroyWindow
GetDlgItem
IsWindow
GetWindowThreadProcessId

shell32

SHGetFolderPathW

newdev

UpdateDriverForPlugAndPlayDevicesW

mprapi

MprConfigServerDisconnect
MprConfigServerConnect
MprConfigGetFriendlyName

kernel32

AddAtomA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetEnvironmentStringsW
GetOEMCP
GetStartupInfoA
EnumResourceLanguagesA
FreeEnvironmentStringsW
WriteFile
GetNumberFormatA
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter

setupapi

CM_Get_Parent
SetupDiGetDeviceRegistryPropertyW
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

iphlpapi

GetIpAddrTable

Sections

.text
Size: 135KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ