fa1d3a9197dba26456d914b34f587547_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa1d3a9197dba26456d914b34f587547_JaffaCakes118
Size

499KB
MD5

fa1d3a9197dba26456d914b34f587547
SHA1

412ec31ff75e808e4665431b15007da72b01c71a
SHA256

c63592ca8fb88a74da9e1bbc1d77bc8e5979ae1859537a2f6929036f343afeb2
SHA512

05869a05e174d2c9dd566459d97923f03c9ce07cfc387185f118305137132c8d6e2d3f8d16ce49f150cdab8bde33e3057b91c411e9e749bb89d87f66256cb58d
SSDEEP

6144:jbdhvkZ8gulzV2V9/H5DTwaHd6dcNiXPnpUTJPyd+MElqwkp7:jDMZu2z96dcYXPnpcJPydjZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa1d3a9197dba26456d914b34f587547_JaffaCakes118

Files

fa1d3a9197dba26456d914b34f587547_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7b45d5fd937c98ed248c8dc80e8a8a0d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SuspendThread
DeviceIoControl
PulseEvent
CancelIo
TlsAlloc
GetModuleFileNameA
DeleteFileA
TlsGetValue
CreateFileA
IsBadStringPtrA
GetACP
GetStartupInfoA
HeapCreate
GetModuleHandleA
GetDriveTypeA
CreateFileMappingA
lstrlenA
ResumeThread
ReleaseMutex
IsDebuggerPresent

user32

DrawTextW
IsZoomed
FindWindowW
GetIconInfo
LoadImageA
DispatchMessageA
GetWindowLongA
CallWindowProcW
DestroyMenu
DispatchMessageA
IsWindow
DestroyWindow
PeekMessageA

amstream

DllRegisterServer
DllRegisterServer
DllRegisterServer
DllRegisterServer

cryptui

LocalEnroll

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ