f5836a466ead36e0d6b6f8134f4c4014_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f5836a466ead36e0d6b6f8134f4c4014_JaffaCakes118
Size

67KB
MD5

f5836a466ead36e0d6b6f8134f4c4014
SHA1

018aa41201d880e0c133d654f6392f05e7879de7
SHA256

d6bf99dcaaee98eb9523329ff0fc24701ac0fb101ef9463cedcbed085bf26367
SHA512

094bb626c26236a6ac4be34a3977a49def7076a40ab215c124f9488954fb2c197be3e81f7f9b624e3536689682f4ef7a44c0e5c79e66c8c0c71ae9166de256ee
SSDEEP

1536:6g/Q47TVN849QI8T7nKx/MWJuTfywaqsy3Gq5G:6sQ47TjZQznS/nuzsqBJ5G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5836a466ead36e0d6b6f8134f4c4014_JaffaCakes118

Files

f5836a466ead36e0d6b6f8134f4c4014_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ca0285ff19034c98eca8e2d51b9c358c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
ExitProcess
GetCommandLineA
GetModuleHandleA
GetVersionExA
HeapAlloc
HeapCreate
IsValidCodePage
SetConsoleCtrlHandler

advapi32

QueryRecoveryAgentsOnEncryptedFile
GetEventLogInformation

setupapi

SetupDiGetClassImageListExW
SetupRemoveFromSourceListW
SetupSetDirectoryIdA

user32

SendMessageTimeoutW

Sections

.text
Size: 54KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ