025546302014d688442764d48fef5602_JaffaCakes118 | Triage

Sharing

General

Target

025546302014d688442764d48fef5602_JaffaCakes118
Size

8KB
MD5

025546302014d688442764d48fef5602
SHA1

7705dd8bf1c2a59b046265b4a04a511eaf73db3b
SHA256

b619cc118d956070add4cbaa99e2427bdbefcd0651ae01d3fd7f6a4d32e9adf5
SHA512

5647ec405b4c8043f1341c48112861c7d296da49ccd0d83a8c1ec091dbf1ecc25736a03b96e747203c061bfb47b0d547965371d774582df34fe7195faf41070f
SSDEEP

96:hP9ALti+LTFrI/EA8DpgH+j7Rh3K2IyB1jaUnfvxfQnMwK+K:hlmtvFrxDpN1NQajtYnO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
025546302014d688442764d48fef5602_JaffaCakes118

Files

025546302014d688442764d48fef5602_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6727067571cc18492cba0928b7fbef1e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindAtomA
HeapCreate
LoadLibraryW
GetEnvironmentVariableW
GetNumberFormatA
InitializeCriticalSection
GetDriveTypeW
FindClose
ResumeThread
GetCurrentProcessId
TlsGetValue
ReadFile
lstrlenW
GetPrivateProfileStringA
LocalFlags
GetConsoleAliasA
CreateEventW
GetCurrentThreadId
LocalFree
SuspendThread

user32

EndDialog
SetFocus
GetClientRect
GetClassInfoA
DrawStateW
DrawTextA
GetKeyboardType
CreateWindowExA
GetSysColor
IsWindow
GetSysColor
DispatchMessageA
CallWindowProcW

srclient

EnableSR
EnableSR
EnableSR
EnableSR
EnableSR

clbcatq

DllGetClassObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ