d12fde4bfbda89c49bae37529584e3e2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d12fde4bfbda89c49bae37529584e3e2_JaffaCakes118
Size

200KB
MD5

d12fde4bfbda89c49bae37529584e3e2
SHA1

2db4b213cb6aa8d5203f14664480cac52de63450
SHA256

61006df60919ad7d8c59765e5b51ae0c5de010d450939fec321cf4db78b4957e
SHA512

0bb9091a3da2b7ee858d873daf6123a17776c93fae12a9b2149ed2c98b768ed43370d9661822d10cb6c19db0a59600c44b40bb713f7220f59ef3d5c7c0dba03f
SSDEEP

3072:9kcw+Dx+4fZDvsOYk5hegsDPpmfL6NcXuaOHMI3wepKCWxsaJSyofTav3mC:acw2xJfZDvvVIDPpmfE+epgxofToWC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d12fde4bfbda89c49bae37529584e3e2_JaffaCakes118

Files

d12fde4bfbda89c49bae37529584e3e2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

753941a278941cf97fe381f3ce27a76a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FileTimeToLocalFileTime
VirtualFree
LoadLibraryA
VirtualAlloc
VirtualProtect
GetEnvironmentStrings
GetProcAddress
SetEvent
GetModuleHandleA
TerminateThread
GetCurrentThreadId
ResetEvent
VirtualAllocEx
LocalLock
VirtualLock
SuspendThread
GetLastError
IsBadCodePtr

user32

IsWindowUnicode
SendMessageA
InSendMessage
GetDesktopWindow
LoadCursorA
IsIconic
GetDC
SetTimer
ReleaseDC
GetCursorPos

gdi32

CreateDIBPatternBrush
SelectObject

shell32

SHFileOperationA

psapi

EmptyWorkingSet

msvfw32

DrawDibEnd
DrawDibStop
DrawDibOpen
DrawDibClose

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ