fec9720f629c39db1a422a12ac1aea85_JaffaCakes118 | Triage

Sharing

General

Target

fec9720f629c39db1a422a12ac1aea85_JaffaCakes118
Size

285KB
MD5

fec9720f629c39db1a422a12ac1aea85
SHA1

f1e818745ad70a89db0a11f4eb969d7e4bc1e867
SHA256

0cbdcf40ccb1989c12c9e85497d539a6acf2eea2a0101dcc23d2c732ccb4a505
SHA512

187aecdf7c0195f9e6dbc5c8956de8ee45124d14c063ebe48cb98c25dbc83a0bd3125d76d98403af97dd37261d91808c49657f952a63aa26006cb0e624c0c616
SSDEEP

6144:sKuzbaLaCdOn1KwVCUyP0Rr7qC7JcvhIidbZzS1T0d5fF4:sBPaLzupwIrPCvtZawF4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fec9720f629c39db1a422a12ac1aea85_JaffaCakes118

Files

fec9720f629c39db1a422a12ac1aea85_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ac9e65d6dd43523dba5df5c3ac7e5f54

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

W:\yMeHgCwWp\owqWnuHO\clvhjvpby.pdb

Imports

user32

SetUserObjectInformationW
OpenInputDesktop
CharLowerW
GetMessageA
GetDC
GetScrollInfo
InvalidateRect
wsprintfW

msvcrt

_controlfp
__set_app_type
atoi
puts
memset
__p__fmode
__p__commode
_amsg_exit
_initterm
_ismbblead
_XcptFilter
iswdigit
strrchr
_exit
_cexit
__setusermatherr
__getmainargs

shlwapi

UrlGetLocationW
ChrCmpIW

kernel32

LoadLibraryA
lstrlenA
lstrcmpiW
lstrcatA
LoadLibraryExA
GlobalCompact
GetModuleFileNameA
CloseHandle
lstrcmpW

gdi32

SetRectRgn
SetTextAlign
CreateBitmap
GetObjectW
SetPaletteEntries
CreateHatchBrush

Exports

Exports

?CreateDlgMessage@@YGHPAXPADK|U

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idir
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 255KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE