fdb195161b160d6fcec9579117d7cf92_JaffaCakes118 | Triage

Sharing

General

Target

fdb195161b160d6fcec9579117d7cf92_JaffaCakes118
Size

77KB
MD5

fdb195161b160d6fcec9579117d7cf92
SHA1

0dd49c6e1123bbfd7c608a92ae70b5072b2fdcee
SHA256

6cfd132944d2545220a0acfb3ac535a86975c12ec7af98513f03ce4e0b6e4d77
SHA512

4e712b87b3bf25b72c71d3c253dad67895da06d6107a3494952e00d39001c0c0f04a48d902ca91eb2377ad589a08bb2a3972c4e307efac94f9a07d69e4652fff
SSDEEP

1536:Ejab9rhCSrSFqtJmhwnASdZFmWBdi+Lai0Yw0:EjabZhCSrS0JuwnpVBwHYj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdb195161b160d6fcec9579117d7cf92_JaffaCakes118

Files

fdb195161b160d6fcec9579117d7cf92_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1b51904180dbc4099bf824bcb96f9155

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

GopherFindFirstFileA
GopherOpenFileW
FtpGetFileW
FreeUrlCacheSpaceA
HttpQueryInfoA

user32

DrawIcon
DestroyCaret
FillRect
GetActiveWindow
GetMonitorInfoW
GetShellWindow

advapi32

ReportEventW
RegFlushKey
DecryptFileW
ReadEventLogW
OpenThreadToken

Sections

.text
Size: 48KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE