eb69dbe5f0183a7d5892e6c7d9f10b5d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb69dbe5f0183a7d5892e6c7d9f10b5d_JaffaCakes118
Size

123KB
MD5

eb69dbe5f0183a7d5892e6c7d9f10b5d
SHA1

eb6159c2380a6e92b418339e4fe0d46da319e5bd
SHA256

5fe7c78d0dd95708aeb0e2da8278bf00f9e60c4ac25435437c04fca58e7a0720
SHA512

2b819046ef09cc3459d3b78b75c5204795e98676abebef471a3d57ea3c6e90375891a9dd6e1aabec9bc0d04841913f656541af79d3cf03b2490452b634462165
SSDEEP

3072:GxDtp3asMPrfkqKysY7xNvLEQ9hFFigcPJEXcDbJHthrTy:6DtpbYamZf3VcoWbZthC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eb69dbe5f0183a7d5892e6c7d9f10b5d_JaffaCakes118

Files

eb69dbe5f0183a7d5892e6c7d9f10b5d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

961b64821d6e09107158877364b0de0b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetStringTypeW
GetSystemDefaultLCID
InterlockedIncrement
IsDebuggerPresent
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualQuery
lstrcmpiA

gdi32

CreateFontIndirectA
SaveDC

shell32

DragFinish
DragQueryPoint
SHBrowseForFolder
SHGetFileInfo
SHGetFileInfoW
SHGetFolderPathA
SHGetPathFromIDListW

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 863B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ