d623b4f803018a4a8c14ff8758297f4e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d623b4f803018a4a8c14ff8758297f4e_JaffaCakes118
Size

249KB
MD5

d623b4f803018a4a8c14ff8758297f4e
SHA1

00009add0b1b00968e642c6c3739ed4809c57cfb
SHA256

b721c2a7356e7ef0f27318aa799ed3270accdcd473896e0df3fcbe2ad16e65b1
SHA512

c4b4a0f6f10d968d32658fed75e01a99d14157fbbadac24934b04d28c7929210a00f75b5423a3dc74fb784a1e64024c91fe88c747b1b321c7853fddb72b430bf
SSDEEP

6144:JoxgyINpRlhw+8IaSwrDKyP85hI94O7BqnYBVohUDIXhPouP:DygRlu+8dSCDKyPmo4OfBsDtP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d623b4f803018a4a8c14ff8758297f4e_JaffaCakes118

Files

d623b4f803018a4a8c14ff8758297f4e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a265c129da7479d711e13083f2b5fb58

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecW

kernel32

LocalAlloc
UnmapViewOfFile
MapViewOfFile
LZSeek
FormatMessageW
GetUserDefaultLCID
Sleep
CloseHandle
GetLastError
CreateFileMappingW
LoadLibraryA
LocalAlloc
FoldStringW
GetAtomNameW
FreeLibrary
LoadLibraryW
GetSystemDirectoryW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
TlsGetValue
GetProcAddress
GetModuleHandleW

user32

PostQuitMessage
GetMessageW
TranslateMessage
DispatchMessageW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

oleaut32

DispGetIDsOfNames
OleLoadPicture
SafeArrayGetElement
GetErrorInfo
SetErrorInfo
VariantClear
SysReAllocStringLen

Sections

.text
Size: 157KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ