0b738f4201c8b8a6bc178c5bb4b72c14_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b738f4201c8b8a6bc178c5bb4b72c14_JaffaCakes118
Size

404KB
MD5

0b738f4201c8b8a6bc178c5bb4b72c14
SHA1

7902f73cda211b192e8e6670abaf9b117840f187
SHA256

bc9bc914e6957fc7601d6670cd4f2fd17a8836f3efdb5f1a249c505694e62bfe
SHA512

cdeb3429af1f3f23e21a236e6615fd295d429016163869eef91ce6cfa2d252ee3d23803a82d3f5572b0d8556906bd8a3c59b732a6f1a5893cf684307179f117c
SSDEEP

12288:ntvGeRPLFTDGi0kdDnxNl3T3iK6dRj8iMstaP:n/RjFvljNlD3jAj4Aa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b738f4201c8b8a6bc178c5bb4b72c14_JaffaCakes118

Files

0b738f4201c8b8a6bc178c5bb4b72c14_JaffaCakes118
.exe windows:5 windows x86 arch:x86

563c12bb19e2c9d1a7c4ad9f7d0ff9da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumCalendarInfoExW
GetStringTypeA
ExitThread
FreeConsole
GetBinaryTypeA
SetTimeZoneInformation
SetEnvironmentVariableA
GetCommConfig
GetFileType
GetShortPathNameW
GetProcessHeap
CreatePipe
GetCommandLineA
lstrcat
EnumResourceTypesW
VirtualProtect
AddConsoleAliasW
SetConsoleCtrlHandler
MoveFileExW

ole32

RevokeDragDrop
CoRegisterSurrogate
CoReactivateObject
WdtpInterfacePointer_UserMarshal

gdi32

GdiEntry10
SetFontEnumeration
CopyEnhMetaFileA
GdiStartPageEMF
GdiAddFontResourceW
CreateColorSpaceW

Sections

.text
Size: 395KB - Virtual size: 671KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ