d9f157795871f167a031d6ce0cb1736e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d9f157795871f167a031d6ce0cb1736e_JaffaCakes118
Size

185KB
MD5

d9f157795871f167a031d6ce0cb1736e
SHA1

d9e7ff1d24fbff3d7a0f90099ba11354ed267d2a
SHA256

15aa5b0aa7cb0d2c935c112d50594361823c3c7fe44c2711250e957c32533212
SHA512

e7ce7e69a134b8b2c1aa6c70099b85833ce82daa23da28301a904fe4dd31118fb455c0c0021aefaf09e13bd8eb0ebd061d1020755091a9216b80b2836e3c6471
SSDEEP

3072:OnreyVQ0113AuFPDXT3p6Aj0qV+JURmLuaQ4dBgjzlPj3efMFudlx:OreSQ03wYAAQqV6URxaQABwzB0MA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9f157795871f167a031d6ce0cb1736e_JaffaCakes118

Files

d9f157795871f167a031d6ce0cb1736e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4eb891a0984c82fff93c396782bf574c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

imm32

ImmAssociateContext

kernel32

GlobalAlloc
SetProcessPriorityBoost
InterlockedDecrement
ReadFile
GlobalLock
WriteFile
CreateProcessW
EnumResourceTypesA
TerminateThread
Sleep
DeleteCriticalSection
GetModuleFileNameW
GetModuleHandleW
CreateEventW
CreateFileW
GlobalUnlock

Sections

.text
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ