f692d4ae4e520fdd004329848fdf3ec1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f692d4ae4e520fdd004329848fdf3ec1_JaffaCakes118
Size

58KB
MD5

f692d4ae4e520fdd004329848fdf3ec1
SHA1

b2717129c3c84347fa04f6a2735317282dfe7a25
SHA256

032fa59992b676649fa82e2089365f98f2e270b41af112a6b74fee66165ce254
SHA512

b49d4effe1d9df83395ca230467350426aa5d2a1db927279a174a4c28d5ddc9dca70a45cfd923fb2664d5f0e54c536a5a15dcaf9fde9760d54a240f138fa6551
SSDEEP

1536:fnC+j4Ql1PFsfdXj6RzDN6ff0tbcFxf1uoVI+:fnh6sRzDN6fMtQHf1j

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f692d4ae4e520fdd004329848fdf3ec1_JaffaCakes118

Files

f692d4ae4e520fdd004329848fdf3ec1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f2d80f28c2c39265522508d25b2a409d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
CreateNamedPipeA
SuspendThread
Sleep
IsValidLocale
SetLastError
GetStdHandle
lstrcmpiA
FileTimeToLocalFileTime
GetVolumePathNameA
CreateMailslotA
lstrcmpiA
lstrcmpiA
GetDriveTypeW
WaitForSingleObject
DeleteFileA
lstrcmpiA
lstrcmpiA
GetModuleFileNameA
lstrlenA
GetProcessHeap
HeapCreate
GetLogicalDriveStringsA

riched20

CreateTextServices
RichEditANSIWndProc
IID_IRichEditOle
IID_ITextHost

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.srt
Size: 1024B - Virtual size: 788B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ