dee0a1b3cb409433301f4fc9d112c85b_JaffaCakes118 | Triage

Sharing

General

Target

dee0a1b3cb409433301f4fc9d112c85b_JaffaCakes118
Size

189KB
MD5

dee0a1b3cb409433301f4fc9d112c85b
SHA1

7b252ca61e697409c1e51ad4d18ce4a3890c2b01
SHA256

f4cb229f2af77da399bd8bd1bbd60333d2249cd9de6b5b486fdb073eae01e3de
SHA512

830266e5024d9b832d65c46e34f2bfafd048d88a11ccb7b366b9aef6161d0b3b5221efe1951006251a911bd2fbd95829f7a1f3bc169db716be5f197af74b03d1
SSDEEP

3072:mJWrUa15ebgwib2MJDJ8s0qWm6vRa6B82DiN2ZHqscUQWAL4y5nIIWG:35eswibBDJ8s0qZ6Zv821HTQWvI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dee0a1b3cb409433301f4fc9d112c85b_JaffaCakes118

Files

dee0a1b3cb409433301f4fc9d112c85b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9a905e2a941f6551e76843922944f736

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedDecrement
SetProcessPriorityBoost
GetModuleFileNameW
CreateEventW
WriteFile
DeleteCriticalSection
Sleep
EnumResourceTypesA
ReadFile
GlobalAlloc
CreateFileW
GetModuleHandleW
CreateProcessW
TerminateThread
GlobalLock
GlobalUnlock

imm32

ImmAssociateContext

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ