d4d11305db579b2c46096490b546f17f_JaffaCakes118 | Triage

Sharing

General

Target

d4d11305db579b2c46096490b546f17f_JaffaCakes118
Size

60KB
MD5

d4d11305db579b2c46096490b546f17f
SHA1

4ddaae5420ec1312af575ea733c05b4c64b082de
SHA256

87fcfacd33d2280472f4e114e8dae67b8187c3a6355131c903279ff8dd3921f4
SHA512

6e86bd3e7e4318001921cab13227e61c1618eea8eafc16e19d5f27598ba00d7ffed4dcc7db9f96da03f14facb8d94f5f22a261134e2a9537aee47104e6db7268
SSDEEP

1536:23IVF7gAVAwHXsbd3gk9zfYL9cRJ0ux26ZNMf2X6:2kgAVAwOd3gk9zficRJtD6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4d11305db579b2c46096490b546f17f_JaffaCakes118

Files

d4d11305db579b2c46096490b546f17f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b9e380d9a9aaa3292ec0fa1e1b1efc05

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

OemToCharW
OemToCharA
GetDC
EnableMenuItem
DefDlgProcA
CreateIcon
CreateAcceleratorTableA
CopyRect
CharToOemA

kernel32

GetEnvironmentStringsW
LocalAlloc
IsDebuggerPresent
GetExitCodeProcess
GetCurrentProcessId
FlushFileBuffers
ExitProcess
VirtualQuery
SetEnvironmentVariableA
DeleteCriticalSection
OutputDebugStringA

advapi32

RegSetValueExA
RegQueryValueExA
RegCloseKey

comdlg32

GetOpenFileNameW
GetFileTitleW

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 833B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 905B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ