d2a0ae6d2964a2bb835e574ec0ce7b1e_JaffaCakes118 | Triage

Sharing

General

Target

d2a0ae6d2964a2bb835e574ec0ce7b1e_JaffaCakes118
Size

350KB
MD5

d2a0ae6d2964a2bb835e574ec0ce7b1e
SHA1

58d810cb47282308b58bd3b3de47aee8e7b5a4ea
SHA256

c02fdfca1dd42b7a7ad24809ec1ec472989cf6ffe6c8418727c52e9c07ec7284
SHA512

665267a1c67c8c1a31894772aaffb7bfef34364e45c15854f4310c01ec27973eb79552be75491313e0ac4a814f021d6564888fb62b035aa89c7829ec5d6061bf
SSDEEP

6144:Mtm0GJyBL2QE+u6urabqyugzFJ2HZhr2gIO6CdmRM98IMhjSLOSQIo/C/nU:MtmfSuFgzFJ2HbrylM98LjYQQ/n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2a0ae6d2964a2bb835e574ec0ce7b1e_JaffaCakes118

Files

d2a0ae6d2964a2bb835e574ec0ce7b1e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

89c953b20568e1864f5f00881c2602fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_stricmp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_makepath
_wmakepath
wcscmp
wcscpy

kernel32

GetCurrentThreadId
LockResource
LoadResource
CompareStringA
FindResourceA
LocalAlloc
LocalFree
CreateFileA
lstrcmpA
GetFileAttributesA
GetProcAddress
GetModuleFileNameA
GetTempPathA
DeleteFileA
CloseHandle
GetCurrentDirectoryA
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
EnumResourceLanguagesA

oleaut32

SafeArrayDestroyDescriptor
SafeArrayDestroyDescriptor
VarFormatDateTime
CreateErrorInfo
OleLoadPictureEx
GetErrorInfo
SetErrorInfo
GetActiveObject
VariantInit
SysFreeString

msimg32

TransparentBlt

Sections

.text
Size: 215KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE