0f792c34e7da3678633810f7afebf6e2_JaffaCakes118 | Triage

Sharing

General

Target

0f792c34e7da3678633810f7afebf6e2_JaffaCakes118
Size

233KB
MD5

0f792c34e7da3678633810f7afebf6e2
SHA1

e39ebf2907b7ebbc81d80e51128a0e2e441590e6
SHA256

f5bd53696898e140d8149b52c68f1d98f6270ed68f268ba06f30eeea99c3bb81
SHA512

a3c7cf0066f3c49a9c72468596a8b361ddbd92e2b0dbce5f3681e39a852fbc00b3d868b58237943c5c9ed4825ecb558f76c590bfa903e8ba6c7acc99c22b810b
SSDEEP

6144:6XypUQ6cDCYKfyVsoxsfLThNvbvAJbshAFJMg:MUUvc+jWxWLTbb4J1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f792c34e7da3678633810f7afebf6e2_JaffaCakes118

Files

0f792c34e7da3678633810f7afebf6e2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

6152c5cb2e9899cfd6722df18d4db3e4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
GetStartupInfoA
GetSystemTime
QueryPerformanceCounter
GetProcAddress
GetModuleFileNameW
GetModuleHandleA
InterlockedIncrement
GetCurrentProcess
GetTickCount
GetCurrentProcessId
IsValidCodePage
CreateMutexA
GetCurrentThread
GetCommandLineA

user32

GetDC

gdi32

ChoosePixelFormat
SetPixelFormat

opengl32

glBegin
wglDeleteContext
glLoadIdentity
glOrtho
wglCreateContext
wglMakeCurrent
glEnable
glVertex2f
glEnd

shell32

ord3

msvcrt

__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
_onexit
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
memcpy
_exit
_XcptFilter

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ