fbe970dfb0216c8307951e23a9705fa9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fbe970dfb0216c8307951e23a9705fa9_JaffaCakes118
Size

349KB
MD5

fbe970dfb0216c8307951e23a9705fa9
SHA1

d5c3283bee4566e2e80d6fabcb2622464a7bffd9
SHA256

2fd1a1a9166da8bf59a5676be37c1a0ac3c3465d4228804838f4cd34aeec39c9
SHA512

6778f41ab622267838beebc36a4ee1ddd0657003c1d72ecdd45ded0899a3161a1a7b0eb37df02ceb0edfa1e38c1bade4c2921c913049df35b24a67e5d17429e8
SSDEEP

6144:4u7Fcsc/YSKwgw6s3afRvhnxuEcThgaozwk4jfvJ+DJIOBw7PTjsti8aFKex:4IrCYSBgw6s3sRvxxIhxk4vcDJIO2PE6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbe970dfb0216c8307951e23a9705fa9_JaffaCakes118

Files

fbe970dfb0216c8307951e23a9705fa9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c2f3cf8f8ba0da11d75f22ec3efbb66c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegDeleteValueA

kernel32

lstrlenA

shlwapi

PathCombineW
PathFileExistsW
PathFindFileNameW
StrCmpNIA
wnsprintfA
wnsprintfW
wvnsprintfW

user32

CloseWindowStation
ExitWindowsEx
GetClassNameA
GetDlgItem
GetDlgItemTextA
GetIconInfo
GetKeyboardState
GetWindowTextA
GetWindowThreadProcessId
MsgWaitForMultipleObjects
PeekMessageA
ToUnicode

Sections

.ijwn
Size: 40KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bmnah
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.der
Size: 5KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ