0a2d243dcf832431ba077590f6d85510_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0a2d243dcf832431ba077590f6d85510_JaffaCakes118
Size

7KB
MD5

0a2d243dcf832431ba077590f6d85510
SHA1

ca2855554b7909159f8b5ac2e6d9e29ed3c59c4f
SHA256

e89eac1bbf97bcad37d0afd054899a7cb98864700423f76395d3556956b6a197
SHA512

4564d8682d62b2b5105692dfba2e0e0674388103f1d3b027c0c1ebf4b8ebeb8136537fbd5ac46bccf1b4ee1e0857ce39e9c900796ce1eee396c28fb77b69d518
SSDEEP

192:BuRzhCTWAl2GF5Fgl2Sv8DRDClAiNEh4Q:oxhCTWAl2G+l2SkDR+BEh4Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a2d243dcf832431ba077590f6d85510_JaffaCakes118

Files

0a2d243dcf832431ba077590f6d85510_JaffaCakes118
.exe windows:1 windows x86 arch:x86

a38bd27e238c999d3f75ba666442541d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ImageList_DrawIndirect
ImageList_GetIconSize
ImageList_SetBkColor
ImageList_Write

shell32

SheFullPathA
StrStrIW
SHFreeNameMappings
StrNCpyA

kernel32

DuplicateConsoleHandle
ConvertThreadToFiber
ConvertDefaultLocale
DeleteCriticalSection

ntdll

NtInitializeRegistry
NtOpenEventPair
NtLockRegistryKey
NtFreeUserPhysicalPages
NtMapUserPhysicalPagesScatter

Sections

.text
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: 4B - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE