fb70a7104f161f98d7cc7ad9918b8e9c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb70a7104f161f98d7cc7ad9918b8e9c_JaffaCakes118
Size

499KB
MD5

fb70a7104f161f98d7cc7ad9918b8e9c
SHA1

e802ce74b670e94297a88ab85e97d00a62f4a601
SHA256

cb502eb3dea14a285a8630c3e10c841192f090fd47f9b3b1bf5e08ff0bbc100b
SHA512

0b16e8880b99a6f613f351120a97e279bd18cc1a5b118c1ca1276ad0c96ba1d1ecae6fefb5898c9b936c442d2b7999e00a4b2d6750b65a0f27df96a67feaea22
SSDEEP

6144:XhvkZ8gulzV2V9/H5DTwaHd6dcNiXPnpUTJPyd+MElqwkp7:xMZu2z96dcYXPnpcJPydjZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb70a7104f161f98d7cc7ad9918b8e9c_JaffaCakes118

Files

fb70a7104f161f98d7cc7ad9918b8e9c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c2e51d00555b34986abd2897172ad8ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SuspendThread
PulseEvent
Sleep
HeapCreate
IsBadStringPtrA
ReleaseMutex
GetFileAttributesA
lstrlenA
IsDebuggerPresent
CreateFileA
CreateFileMappingA
GetDriveTypeA
DeleteFileA
GetModuleHandleA
GetStartupInfoA
GetACP
DeviceIoControl
TlsAlloc
TlsGetValue
GetModuleFileNameW

user32

DispatchMessageA
DestroyMenu
IsZoomed
DispatchMessageA
PeekMessageA
GetWindowLongA
DrawTextW
CallWindowProcW
FindWindowW
LoadImageA
GetIconInfo
DestroyWindow
IsWindow

asycfilt

FilterCreateInstance
FilterCreateInstance
FilterCreateInstance
FilterCreateInstance

cryptui

WizardFree

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ