ea5a7cea8484f4488e1a1123702cde39_JaffaCakes118 | Triage

Sharing

General

Target

ea5a7cea8484f4488e1a1123702cde39_JaffaCakes118
Size

15KB
MD5

ea5a7cea8484f4488e1a1123702cde39
SHA1

07abc27752540e046822e5e2b5786d966adf4248
SHA256

f13d1836d4be606a1dc8003d4565d6bb41018ea2c0ee6671256a086670db3f09
SHA512

3913d433071962ca9273e258c44403dc02f24cc793b23dceb2b55ce30ca2ae7f6689ea9cec9f6e0a96eee13a96b4ec5b7ddd313624bafa5a664f9288aaf02d34
SSDEEP

192:h85Uj//nTFQojIAOGwEAyvvKfKKKt5UA3G8LY5jIsrgTjH/OQ9flRbMHajQWE007:W5UjXY7byvrpWceyNRbM63E00Xr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea5a7cea8484f4488e1a1123702cde39_JaffaCakes118

Files

ea5a7cea8484f4488e1a1123702cde39_JaffaCakes118
.exe windows:4 windows x86 arch:x86

73d3e942124f6815e0dd8aa673cdca94

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SuspendThread
ResumeThread
GetModuleHandleA
CreateFileA
CancelIo
ReleaseMutex
TlsAlloc
lstrlenA
IsDebuggerPresent
DeleteFileA
GetStartupInfoA
GetDriveTypeA
GetACP
PulseEvent
TlsGetValue
GetModuleFileNameA
CreateFileMappingA
HeapCreate
DeviceIoControl
IsBadStringPtrA

user32

CallWindowProcW
DrawTextW
DestroyMenu
GetIconInfo
DispatchMessageA
PeekMessageA
LoadImageA
FindWindowW
DestroyWindow
GetWindowLongA
DispatchMessageA
IsWindow
IsZoomed

amstream

DllRegisterServer
DllRegisterServer
DllRegisterServer
DllRegisterServer

cryptui

LocalEnroll

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ