09f315646854d7024b4c7c261b0a29f0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

09f315646854d7024b4c7c261b0a29f0_JaffaCakes118
Size

49KB
MD5

09f315646854d7024b4c7c261b0a29f0
SHA1

935b6a1bd975cb080043e5cb3f67e4ff5e5658ac
SHA256

61668bc1cffc2b06f3cf74728a1a65bd44c080f89e5cfe51abf4fd9778fcee31
SHA512

32af8a12d06f4e4d52a1bea0a3fc4725373220cc66c57a0fdf4e8241a84325ba73a947d84ed2151862ca60d99769967fef14317b9ba1d0b728042599188bd3af
SSDEEP

768:e3fLHq+v4tiiiii5vWMoZ/56lVbYuGGaql3ti7sHMTtNIBQJbvRJcvnyNQC+NaHR:qLHvv4a3pfYRf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09f315646854d7024b4c7c261b0a29f0_JaffaCakes118

Files

09f315646854d7024b4c7c261b0a29f0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fc60a920495dd603b6329f9f82fb28de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Acro_root_apms\build\Release-results\info\template.pdb

Imports

kernel32

GetModuleFileNameW
GetProcAddress
LoadLibraryW
HeapFree
GetFileAttributesW
HeapAlloc
GetProcessHeap
GetCommandLineW
SetStdHandle
ExitProcess
CreateFileW
GetModuleHandleW

shell32

CommandLineToArgvW

msi

ord173
ord205

user32

MessageBoxW

shlwapi

AssocQueryStringW
StrCmpW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ