0afb9f040cd7c3afd7ced49c5d469bc1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0afb9f040cd7c3afd7ced49c5d469bc1_JaffaCakes118
Size

1022KB
MD5

0afb9f040cd7c3afd7ced49c5d469bc1
SHA1

df96d49cc7f979d16b081062a84af0a431a361f8
SHA256

09ce743ce26dac9610428a5a8aed12bf0aa793a3c243ab18ca36d73210876c8a
SHA512

28ee585415d4e11198719c5c1bd5ef3ffb15c61ec19f90ac23dca9dbf9153070dc89b647d334cc3fcfc61af809af4dede2e59017e37cd05af0e0b13e61c26217
SSDEEP

24576:ITU2d3AL5/OwKa/HrAt8PYQdwirDlcqFwMmVs:ITeLKEAkCi33FwMmK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0afb9f040cd7c3afd7ced49c5d469bc1_JaffaCakes118

Files

0afb9f040cd7c3afd7ced49c5d469bc1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9f08268493c8319d1d4ad752f91557a8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
LoadLibraryA
CloseHandle
LocalAlloc
GetStartupInfoA
GlobalAlloc

gdi32

PatBlt
GetTextMetricsA
GetTextColor
DeleteObject
ExtTextOutA
SetBkMode
CreateFontIndirectA
SelectObject
GetStockObject
GetObjectA
MoveToEx
LineTo
GetPixel
CreateSolidBrush
GetTextExtentPoint32A
GetDeviceCaps
SetPixel

Sections

.text
Size: 1024B - Virtual size: 1013B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1016KB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ