f036eccf60b68b30859faf6019139004_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f036eccf60b68b30859faf6019139004_JaffaCakes118
Size

177KB
MD5

f036eccf60b68b30859faf6019139004
SHA1

db4dbe78730d81cdab87ae3b5e23645e086bd6ee
SHA256

1a562a76580249c628262b4d9edb1195b336015d1b618c63f09fb1a2e93ed976
SHA512

81aefd1cddf472b17ea7aa3da9a8e3d0dd27dbdb7678760f4e346df33f4c15cb778851477ab11feaa71637d046beddc0670bca41af677d87d4c9a69d9d8d9cfa
SSDEEP

3072:JS08L2GsbNyYMUC8y89J7bmiGkQj7NWcaYG6Q3Jvmor3eil+UT6vtscZ0xlz1:JE5sbxMUTy879GkUgTYjQ3Jvj1lveW2k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f036eccf60b68b30859faf6019139004_JaffaCakes118

Files

f036eccf60b68b30859faf6019139004_JaffaCakes118
.exe windows:4 windows x86 arch:x86

881cb16b751b67c5b25e9a9a3c369e4f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED

Imports

winspool.drv

DocumentPropertiesW

user32

CharNextW
PostThreadMessageW
DispatchMessageW
TranslateMessage
CharUpperW
SetTimer
GetDC
GetAncestor
GetMessageW
KillTimer
wsprintfW
UnregisterClassA

kernel32

MultiByteToWideChar
FindClose
lstrcpynW
GetCPInfo
CheckRemoteDebuggerPresent
WideCharToMultiByte
lstrlenW
GetACP
GlobalAlloc
EnumResourceTypesW
lstrcpyA
GlobalFree
OutputDebugStringW
DeleteCriticalSection
InitializeCriticalSection
lstrcpyW
LockResource
lstrcmpiW
GetLastError
GetTickCount
GetModuleHandleW

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.isete
Size: 1024B - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ