fa76a16ae1e76d2b22ab40072f735e13_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fa76a16ae1e76d2b22ab40072f735e13_JaffaCakes118
Size

167KB
MD5

fa76a16ae1e76d2b22ab40072f735e13
SHA1

abeb7ff173a9e353df770c6d4af828c96bfcbb1a
SHA256

c1efb86b74570204a96a6f55b81e5c549d490450afd42f3f08d6aad306166254
SHA512

8b03eeb381460e431333946019f0387d6f75e40fd5ef4f75555ad309fecfc0c59e870097b5da023d1f0905203c44674e3966709fc6eeca6b27055250342ba45c
SSDEEP

3072:J1sG2ciAKnZYfObmo5GcJKlcs6q4XFHHS+sU9RG8Z4prQ2LRZ:J1jYAKe2m96q44UHdGQC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa76a16ae1e76d2b22ab40072f735e13_JaffaCakes118

Files

fa76a16ae1e76d2b22ab40072f735e13_JaffaCakes118
.exe windows:5 windows x86 arch:x86

81c31da05b5ebab36c41091841650912

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\jyonCnNpxZlJwh\XatGWiula\ykpwhKiLfNdzPd\adufkrM\dbephmbdM.pdb

Imports

kernel32

SetThreadContext
GlobalMemoryStatus
GetProfileIntA
ResumeThread
GetProfileStringW
ClearCommBreak
GetSystemWindowsDirectoryW
GetShortPathNameW
ConnectNamedPipe
SetupComm

shlwapi

PathUnquoteSpacesA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

user32

MessageBoxA

gdi32

AddFontResourceW
DeleteObject
FillRgn
CreateRectRgn

Exports

Exports

?ToTestFunction@@YGKXZ

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug01
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ