028b85a68cbeef5af69a08e8b6624987_JaffaCakes118 | Triage

Sharing

General

Target

028b85a68cbeef5af69a08e8b6624987_JaffaCakes118
Size

1012KB
MD5

028b85a68cbeef5af69a08e8b6624987
SHA1

4b176880f8787ed2ce4d04890cd373f0d56845f2
SHA256

09a13e684908f566cfbc9da77e01c69005428dd61c53b43310b332eaa85db719
SHA512

9e1a91a987ed67d32caa627ad1f51207a9cb3aee1a4decaeca77e6a44e5c764bc3ab3e389a8cc65aac1fcae9799af5700afbac06938de072ef8a4cf63ea3b994
SSDEEP

24576:rNCj8Ru4271EDLRdl0bSNdc6B38egKvQSJdkM8Hf:fRu4W8Rdl0mHnB3kEdkM2f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
028b85a68cbeef5af69a08e8b6624987_JaffaCakes118

Files

028b85a68cbeef5af69a08e8b6624987_JaffaCakes118
.exe windows:4 windows x86 arch:x86

400f7a688fc2acaebed7af5cdc03df41

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysStringLen
DllUnregisterServer

kernel32

GetModuleHandleA
GetStartupInfoA
GetCurrentProcess
MultiByteToWideChar
InterlockedIncrement
ExitProcess
TerminateProcess

Sections

.text
Size: 839KB - Virtual size: 839KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.version
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ