db44f5d0677c0ce88ada0034afbec0b2_JaffaCakes118 | Triage

Sharing

General

Target

db44f5d0677c0ce88ada0034afbec0b2_JaffaCakes118
Size

172KB
MD5

db44f5d0677c0ce88ada0034afbec0b2
SHA1

74dda14e9e4ff68b41bd77624387da47c54e7123
SHA256

59013f257a1af905cdd2f02b16ea4bf22c95197094ed81d125791099c78d6180
SHA512

ed1de823cfd977fd017834ee7d2d8ee10746310322d6cb97925090974c7192a1376e01beb472565e026f31f6348616d206919cab259edad900a769411dda53a9
SSDEEP

3072:+QT7Rt1LirDrLSwety8argLVCKJ4YsbvsEqY+pwTHWCu6yqcCvQgJj6B:5T7RtlAqtyNrfKJ4FbvsEAyr3yHCvQgg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db44f5d0677c0ce88ada0034afbec0b2_JaffaCakes118

Files

db44f5d0677c0ce88ada0034afbec0b2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b6649347a400d9ea852513cdd4c4c14d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

W:\vzbOuorLz\nekuxarv\yNodaJcy\fvFukSsUjr\vwtmHXYwo.pdb

Imports

kernel32

LockResource
GetACP
GetComputerNameExA
LCMapStringW
LoadLibraryA
GetFileInformationByHandle
GetStartupInfoA

shlwapi

PathUnquoteSpacesW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

user32

MessageBoxW
KillTimer
GetForegroundWindow
CheckRadioButton

ntdll

RtlCompareMemory

Exports

Exports

?InsertCustomData@@YGKXZ

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pack1
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ