152406ac1931eb1f05746c62c4328303_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

152406ac1931eb1f05746c62c4328303_JaffaCakes118
Size

697KB
MD5

152406ac1931eb1f05746c62c4328303
SHA1

8a77157382b75762c1ff3b42bb3531467f425781
SHA256

deb6bb02b0b6c5fd971598af5c105f9296bd357d014e23c31a7a8ff32671ac12
SHA512

ba3c0eb0704affd260729880a181ebe7e277a6bde9dd25e00282548cdf993fa97225b97efd6d3dc2845fb220911d5b1a7dfab531b3d2e2c688d1753dfcc89c2b
SSDEEP

12288:BcUk9EIdjJ28OssuZWj1W1v2xehk0Xrj1kRiWuoe6p2d/NegBKq:Bc9Ldl28OssuZkW1v2xwk0bZkEWJrGeU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
152406ac1931eb1f05746c62c4328303_JaffaCakes118

Files

152406ac1931eb1f05746c62c4328303_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f75168d64597984c5fdae1cdd5162476

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetVersion
GetFileSize
LocalAlloc
GetCommandLineA
LocalFree
GetModuleHandleA
GetStartupInfoA
Sleep
lstrlenA
lstrcpyA
CreateEventA
GetTickCount

msvcrt

_exit
exit
wcstoul
memmove
_c_exit
__p__commode
_XcptFilter
__CxxFrameHandler

gdi32

GetObjectA
MoveToEx
GetTextColor
GetStockObject
GetTextExtentPoint32A
CreateFontIndirectA
BitBlt
ExtTextOutA
GetBkColor
DeleteObject
GetPixel
SetBkMode
SelectObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 673KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 724KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ