04e75efb640b5f09e4f66d28c7d0705d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

04e75efb640b5f09e4f66d28c7d0705d_JaffaCakes118
Size

172KB
MD5

04e75efb640b5f09e4f66d28c7d0705d
SHA1

bff8d491a3e62e7a49327f6a326f370b3aedcac4
SHA256

b310fb975adf07d10d418a0fbee5f9e67cfc0bfe9f4ef7eb25fd5ddfc1c315a3
SHA512

e81f8737f00e607d7a070ff7b25ec7afccadbc981e8bfcc09de4dfa81ae2f7aceb135765d659c1ce3d52a31bd2f4d3ffca932497d86fd13b63f73209e0eb6366
SSDEEP

3072:dTe3XZsLjPjUjyGxx4zNGKNRbDt6LUSvGhvDMKvvF:dTMSLjPYCGKNRbRD/1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04e75efb640b5f09e4f66d28c7d0705d_JaffaCakes118

Files

04e75efb640b5f09e4f66d28c7d0705d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a5629b2732c067b4a818f5f4c70bb35c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetUnhandledExceptionFilter
ReplaceFileW
InterlockedExchange
IsDebuggerPresent
GetProcessId
Sleep
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcessId
EnumResourceTypesA
GetTickCount
UnhandledExceptionFilter
ExitProcess
InterlockedCompareExchange
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
GetCurrentProcess

comctl32

InitCommonControlsEx

clusapi

CloseCluster

shell32

ShellExecuteW

user32

EnumDisplaySettingsW

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ