fade00318a27ed793e120c632f74fa3d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fade00318a27ed793e120c632f74fa3d_JaffaCakes118
Size

300KB
MD5

fade00318a27ed793e120c632f74fa3d
SHA1

d86a8d1b0de44df3c524df14bad562da1d97e0bd
SHA256

509b43a7f796e39a37a2122dcfc03ee39d96b8a67618db0ec7a66b42421bc992
SHA512

f8aceb8224684e82d91e9fa1414df57d698d4bd1848d4b5d6dee6a56db3b5694184e77df5355375e145084690bfc602ee1d73cc0ce76dc7069f515195c410a4e
SSDEEP

6144:pZ8zryscOOUUPm0Qg+A0uw6sYZ1rjqYEojLNF7gWg:pZ8zGscOOHm0L+1HuXhFTUWg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fade00318a27ed793e120c632f74fa3d_JaffaCakes118

Files

fade00318a27ed793e120c632f74fa3d_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e4f36323c6f26103d0bfabf62d80b56b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

TranslateMessageEx
OemToCharBuffA
CreatePopupMenu
GetActiveWindow

kernel32

CreateProcessW
VirtualProtect
SuspendThread

ole32

CoReleaseServerProcess
OleUninitialize
DllRegisterServer
CoUninitialize
HBITMAP_UserFree
StgIsStorageILockBytes

Sections

.text
Size: 286KB - Virtual size: 285KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ