eabb676da6bab7a0bf48ee5cd9014a20_JaffaCakes118 | Triage

Sharing

General

Target

eabb676da6bab7a0bf48ee5cd9014a20_JaffaCakes118
Size

101KB
MD5

eabb676da6bab7a0bf48ee5cd9014a20
SHA1

d9ea9cacf47be7e9873e7dc6673ac88defdebd40
SHA256

d19a7c759d0f4107ab3b0b7837c7c892e15e802768298d20a8a6a8db28652a3d
SHA512

71212b2571116bac31048920384589161dc475b77d05a38feae538a9a2e72520f067d220d7cea4b8804e6690d63dd1a286f06d1514801e3e938f9a1103e93dc6
SSDEEP

3072:sa7kXfxca8GZGkQJlMd1ptwRdHYnaAr46C:sa78PvZnMkznaA4n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eabb676da6bab7a0bf48ee5cd9014a20_JaffaCakes118

Files

eabb676da6bab7a0bf48ee5cd9014a20_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e64f9cfcc7180c820b64d33bf41e46c7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessId
LoadLibraryExW
ReadFileScatter

ntdll

RtlGetCompressionWorkSpaceSize
RtlAppendUnicodeToString

advapi32

AccessCheckByTypeAndAuditAlarmW

gdi32

SetMapperFlags
SetGraphicsMode
SetBitmapBits
SetStretchBltMode
PatBlt
MaskBlt
GetStockObject
GetRandomRgn
GetPolyFillMode
GetBitmapBits
SelectClipPath
CreateDIBPatternBrushPt
CreateEllipticRgn
EnumFontFamiliesW
ExcludeClipRect
ExtFloodFill
ExtSelectClipRgn

rasapi32

RasGetEapUserDataW

oleaut32

SafeArrayDestroy

shell32

ShellExecuteA
PifMgr_SetProperties

ntdsapi

DsCrackNamesW

appmgmts

CsEnumApps

dpmodemx

SPInit

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE