dc8310d7923ac2691c790ec3a03605a7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dc8310d7923ac2691c790ec3a03605a7_JaffaCakes118
Size

170KB
MD5

dc8310d7923ac2691c790ec3a03605a7
SHA1

6b64b50a34ba23ce61cd179f91c0d97356bdfc1c
SHA256

4d81c4df67a9d8688a1e6e3a169660c12a3bf7fbad983f3db02dd72a41f360d3
SHA512

dc44644eb20ef59dd743ca5dc01734a3621e6daef91229efc234217dcde3324f9069119378575fe9116e8f25c5305d4e2336702bf3cb20979735c029c7b977ab
SSDEEP

3072:3iaoDZ6pM0V/7pZuaoyuTSoKhLuRwAOB/NcBL1:aKM0v0ryuOoKhK6AOB/C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc8310d7923ac2691c790ec3a03605a7_JaffaCakes118

Files

dc8310d7923ac2691c790ec3a03605a7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ae2e6b0429d331cefbce98468257dabb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
lstrlenW
GetShortPathNameW
LoadLibraryA
GetModuleHandleA
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
GetProcessTimes
IsDebuggerPresent
FreeLibrary
LocalFree
CloseHandle
IsBadWritePtr
GetProcAddress
InitializeCriticalSection
EnumResourceTypesA
MultiByteToWideChar
IsBadReadPtr
lstrlenA
ExitProcess
GetCurrentThreadId
DeleteCriticalSection
GetCurrentProcessId
CreateFileA
GetThreadLocale
GetVersionExA

msvfw32

ICClose
ICOpen
ICSendMessage
ICDecompress

user32

wsprintfA
wsprintfW

ole32

StgCreateDocfile
StgOpenStorage

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ