f72a30cde7f388c09d5756ff7e652c93_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f72a30cde7f388c09d5756ff7e652c93_JaffaCakes118
Size

115KB
MD5

f72a30cde7f388c09d5756ff7e652c93
SHA1

fd1006356ee7f498b7ee98041319dfbd3e87f371
SHA256

6168a9478ad9cb1eebf8a4abd0d5147293b3193a6edbd755c8b0982dbbce6c35
SHA512

2f705aba174293be453df70cb1fe41d90154cbb3fce922b7e86386eb2dcf8eaee892e5b6ea0b6f57dfa99c53c4ce8b3eb884c5e895211679b020ba98c1365ea4
SSDEEP

3072:LwUeOVnUFEckGZTMvFvAyBDON/+nGKr3P12Fy:l1YVklvFvDBDONaPAF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f72a30cde7f388c09d5756ff7e652c93_JaffaCakes118

Files

f72a30cde7f388c09d5756ff7e652c93_JaffaCakes118
.exe windows:4 windows x86 arch:x86

786c270f9bf875c3346c75a1ea619a6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

InvertRgn
PolyPatBlt
RectVisible
CreateRectRgn

msvcrt

_copysign
__p__tzname
__p__wpgmptr
_mbsnicmp
_dup
_getws
_inp

kernel32

CreateEventW
GetCommConfig
GetCurrentProcessId
GetThreadLocale
LocalAlloc
LocalHandle

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 91KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE