0417d8c147039cb9c0b5e776e88976f5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0417d8c147039cb9c0b5e776e88976f5_JaffaCakes118
Size

132KB
MD5

0417d8c147039cb9c0b5e776e88976f5
SHA1

3274deee76dad9a13ad73d668263f4129e888c1a
SHA256

fabf7c9e4c6ef1f8549c797bcbd41902e3171a1a7e2fb03366fa2c6ba3a00825
SHA512

142bfd2e5ad9c64489b279fb2c214b898134e24c0ca7dfcb011f9dcd7d7b7be4159bd2389ac55d98d54e09f4a98f025324fc15e99178a3d5f5f81396804b2382
SSDEEP

3072:YjdqGjeTbGnAdRBepR6MZr8CZoOGgTOa3WVg2oG7:4dqcOvdRuLr8elxGD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0417d8c147039cb9c0b5e776e88976f5_JaffaCakes118

Files

0417d8c147039cb9c0b5e776e88976f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5549d8829f3cbfabc7c2f004e53289f8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

DoEnvironmentSubstW
DuplicateIcon
RealShellExecuteW
Options_RunDLLW
Control_RunDLLA
SHFileOperationA

comdlg32

ChooseColorA
dwLBSubclass
PrintDlgExA
FindTextW
ReplaceTextW

Sections

.text
Size: 89KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE