d99db91bd53e454355138c347a81e396_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d99db91bd53e454355138c347a81e396_JaffaCakes118
Size

28KB
MD5

d99db91bd53e454355138c347a81e396
SHA1

f0e37c7d884656cdd6e580b99b42d41ef26da28b
SHA256

07eb261a8f86c82d25969b479a5fdb997ec4f22ac59abfe193a909f657d18f1f
SHA512

9062609f4fb82338895d0788a172a674d3aed3bc70e7668bac677a9e1a2f35a70bb82a8e347123f523aceb91241099e19c21eb9c5db240f49215e18e8957d177
SSDEEP

384:69BgL5z/CHXQqzVxAIY0JPE4HEYqKksWCAREqGFkOb7YcE08B0:V/CH/VxAIY0JP5uZrjRtGFtREs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d99db91bd53e454355138c347a81e396_JaffaCakes118

Files

d99db91bd53e454355138c347a81e396_JaffaCakes118
.exe windows:4 windows x86 arch:x86

233d43c85d3e6d8c909589d1c7274413

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetCursor
LoadImageA
GetMessageA
DrawTextA

kernel32

SetEndOfFile
lstrcmpA
WriteFile
VirtualAlloc
TlsSetValue
EnterCriticalSection
EnumResourceLanguagesA
EnumResourceNamesA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
Sleep

ole32

CoInitializeSecurity
OleCreateLink
WriteClassStg
CoGetCurrentProcess

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

code
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE