d0d6dbd89452d97a7600e6b5f0c4980b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d0d6dbd89452d97a7600e6b5f0c4980b_JaffaCakes118
Size

172KB
MD5

d0d6dbd89452d97a7600e6b5f0c4980b
SHA1

9e75d42e279fcef34682d8ea21fe6ec3660ec876
SHA256

51ba8880d57357f69df692e803cb5e79c9fdbeb495212bed202cf2527d51b215
SHA512

2569a332d180e27005ebc18f5950485798c131c81d1b99c2691853e9d10374e96eed594f26be36e2b91b551219499da583993e94c54644482a3e3e45783f97c4
SSDEEP

3072:XOFIm58dVgw8uQrbHzhiqx4qvQ5Ojk+vCqpOV5V8jEn4n7uo80v3wJ2ecs4S9fv1:XOF3SdAuGRiq93jTPpA5VX47twJo7S9l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0d6dbd89452d97a7600e6b5f0c4980b_JaffaCakes118

Files

d0d6dbd89452d97a7600e6b5f0c4980b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f4429a381a23128cb50a34fa952fd2e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadConsoleOutputA
ConvertThreadToFiber
SetTimerQueueTimer
SetConsoleTextAttribute
SetProcessPriorityBoost
SetConsoleCursorInfo
SearchPathA
QueryActCtxW
ReleaseMutex
SetThreadContext
CloseHandle

user32

SendMessageA
PtInRect
GetInputState

advapi32

ConvertSecurityDescriptorToStringSecurityDescriptorW
RegQueryValueExW

gdi32

SetBkMode
Ellipse
SelectPalette
GetMetaRgn
GdiTransparentBlt
Arc
ExtSelectClipRgn

msvcrt

_getpid

oleaut32

SafeArrayGetVartype

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ