f0064c1eeb22045a570a51a459a34f3f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f0064c1eeb22045a570a51a459a34f3f_JaffaCakes118
Size

123KB
MD5

f0064c1eeb22045a570a51a459a34f3f
SHA1

98a37d2850b1f66eeee7718906119a1dc785bc4b
SHA256

414d0424c60c1095da5efea60693ddc43df0925a17c4a28c17b4584281c81a70
SHA512

026c4de456025c857b7fcd3bc10543ba7f78a5049d8a837c976f946f4ac2e3710ce6438f7b314763620a5152c4e2b8364f56bdc97c04be6537f5819180e1f4b9
SSDEEP

3072:kzmEvZ89UXNUuwXFVpkI3cr3WBPW77hi7dpStr9:wbZ8oyFVnS36Px7dpStx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0064c1eeb22045a570a51a459a34f3f_JaffaCakes118

Files

f0064c1eeb22045a570a51a459a34f3f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2f072c28ca5a10d7f10c7d2e9987b561

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetExitCodeProcess
ClearCommError
CreateProcessW
ExitProcess
ClearCommError
ReleaseMutex
EnumResourceNamesW
CreateFileMappingA
ExitProcess
CreateMutexA
GetStartupInfoA
MapViewOfFile
QueryPerformanceCounter
GetModuleFileNameW

user32

CharNextA
GetMessageA
CharUpperA
SetTimer
PostThreadMessageA
PeekMessageA
KillTimer
LoadStringA

shlwapi

PathFindExtensionA

rpcrt4

RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcBindingSetAuthInfoA
RpcStringFreeA

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ