0f24164a4973c7b9d8a23531cf0d3db8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f24164a4973c7b9d8a23531cf0d3db8_JaffaCakes118
Size

147KB
MD5

0f24164a4973c7b9d8a23531cf0d3db8
SHA1

bbac9914869cf2f71b272fe747e8514cb3f6084a
SHA256

82a25e1c70b70b89354682caf3fa0445fae450cf465d00b5cd6928ff3c4252e7
SHA512

6843864013033b983f92af12154a5e8efb070fb66702c1ff365e997093a01df55fcb910a8c1515831c6cde3499d8ee6aba820fdb5bf8760450db7042d5e5ad0e
SSDEEP

3072:CrxPRCvW3eALlOmoFbZc7dhH1RVrkhYKbO23QlYUI:CrFRCvW39kmosdhVRVkJOOQlYUI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f24164a4973c7b9d8a23531cf0d3db8_JaffaCakes118

Files

0f24164a4973c7b9d8a23531cf0d3db8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b5b5ae7f54e2316d8e5a6830e5c618b9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoW
GetCommandLineA
RtlUnwind
GlobalFlags
GetModuleHandleExA
GetEnvironmentStringsW
GetProcessVersion
GetProcAddress
SetLastError
GetLastError
FreeLibrary
lstrcmpiA
lstrlenA
GetModuleHandleA
GetVersion
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentVariableA
LocalFree
GetVersionExA
FreeEnvironmentStringsW
LoadLibraryA

shell32

ShellExecuteExW

shlwapi

SHDeleteKeyW
PathCombineW

ole32

OleInitialize
CoQueryProxyBlanket
OleInitialize
OleUninitialize

Sections

.text
Size: 57KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 286B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ