e1e7ad516754cc0d16f594802478e329_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e1e7ad516754cc0d16f594802478e329_JaffaCakes118
Size

198KB
MD5

e1e7ad516754cc0d16f594802478e329
SHA1

6d559583517ca7da2b3f5c144edf28b0692531cd
SHA256

0425deb27e7997a5648c144e0003d877207806867c8899ace4f0a55156e99336
SHA512

0bf9bd13a9c994d083bd211a90f02b75d15770bbb34a482937b99c9fa3b539f21641f94002b44b5a3104417ace00e037d2eb7d53f40834044795b1c4771e4a97
SSDEEP

6144:S6tpZlwtZnCQwWsf6YX/Hx6KQIdNj8uH5DtfjwoipM:SWLlkCpj4ZWZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1e7ad516754cc0d16f594802478e329_JaffaCakes118

Files

e1e7ad516754cc0d16f594802478e329_JaffaCakes118
.exe windows:4 windows x86 arch:x86

33083ed183f8fab8e28775ebc57d84b4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle

ntdll

RtlCreateQueryDebugBuffer
RtlRemoveVectoredExceptionHandler
RtlGetActiveActivationContext
RtlIntegerToUnicodeString

advapi32

RegDeleteKeyA

gdi32

GetNearestPaletteIndex
GetMetaRgn
GetFontData
GetDeviceCaps
EndPath
GetPixel
GetSystemPaletteUse
StrokePath
SetRectRgn
SetPixelV
SetPixel
GetTextAlign
CreateScalableFontResourceA
CreateHatchBrush
CreatePen
DeleteObject
SetBkColor

comctl32

RemoveWindowSubclass

wmvcore

WMCreateWriter

Exports

Exports

KBmol

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1009B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ