efa35a99d86c378601e0259551a8a000_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efa35a99d86c378601e0259551a8a000_JaffaCakes118
Size

89KB
MD5

efa35a99d86c378601e0259551a8a000
SHA1

4c2a7526289b5dfa94cdd275a68d91202f71dc57
SHA256

e536bfdab3eac695c693dc63e28a5500c0b8cbcea65765b0898c9a7666eb8718
SHA512

7063f5107c20f7f70c88e1a5b84a74dd87df0ae06922223a4fb5f7c955165285e1344edbd925b68fcd36c89ba4955c917fee6f406af0c2bf87d817f4483c0969
SSDEEP

1536:BFvy7YsCQXNzInTRmmgn4/sZ6zGr5mPBHLv:VRwMMm/BzGtKB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efa35a99d86c378601e0259551a8a000_JaffaCakes118

Files

efa35a99d86c378601e0259551a8a000_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7045a71c1b424ed978d4082fe7a839c6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
GetStartupInfoA
LoadLibraryA
GetCommandLineA

gdi32

ColorMatchToTarget

comdlg32

GetOpenFileNameA

comctl32

ImageList_AddMasked
ImageList_BeginDrag
ImageList_Copy
ord2
ord17

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.BSS
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.DATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ