f9c3f99beaa51f5c0913b1a2e63a72db_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f9c3f99beaa51f5c0913b1a2e63a72db_JaffaCakes118
Size

168KB
MD5

f9c3f99beaa51f5c0913b1a2e63a72db
SHA1

249e1625216b2a54f190347b79543b8d5bcb7e3d
SHA256

d044524595ffbf8c6f8be1f5a225f06ba0bef5d59a08fc83af2aff03fc20110b
SHA512

4c4e8538cc8bc6b2455cc90a29f63bffdab191c486a19bb055464902ca6a6cec7bc2e7d93ff266f9386c3780fe0b87e56383abd62fc0f412fdf4b1f14d83c756
SSDEEP

3072:BKbOCNrakyUSPd8CLc5hNMNhtV3530QtEpcSGVqX/15aZHA5:o5NFSPd8Rbq3p39S15

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9c3f99beaa51f5c0913b1a2e63a72db_JaffaCakes118

Files

f9c3f99beaa51f5c0913b1a2e63a72db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4e6f65b814f6c18f58a853caec15c47b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

LresultFromObject

kernel32

PrivCopyFileExW
MapViewOfFile
GetProcessId
CreateFileMappingA
EnumResourceTypesA
ExitProcess
DeleteAtom
AddAtomW
ProcessIdToSessionId

user32

CreateWindowExW
GetWindowInfo
GetUpdateRgn
EndDialog

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ