1156b18ab89dbda94509bc37bbf7cf2a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1156b18ab89dbda94509bc37bbf7cf2a_JaffaCakes118
Size

498KB
MD5

1156b18ab89dbda94509bc37bbf7cf2a
SHA1

344ac778c91ae95f0d8ca38948ed719d27d119a7
SHA256

bd2c5d6619154930db3d80da7433d7a48efdb23e466e7b3df9606a72b47c7287
SHA512

40a9f80c1ff92fd73e1c6b5ab1dcd9d0736225d276834a1d0d7c56e04f1952e64114305efb4d633650ca4232725a88e2f752057a3a3c7703cdd48fb6352e041d
SSDEEP

6144:yChKBgqJMYucH+Sv2UDn+C0jj3+VAurnVv4Ch9s7cae6ZaKSqeABLs1SWcDDDDk:yChqgqJMaHp27j34GCfs7cafE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1156b18ab89dbda94509bc37bbf7cf2a_JaffaCakes118

Files

1156b18ab89dbda94509bc37bbf7cf2a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3518efc6926ee5ff2f082d11931d84ff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
PulseEvent
CreateFileA
Sleep
IsDebuggerPresent
GetModuleFileNameW
lstrlenA
DeviceIoControl
IsBadStringPtrW
HeapCreate
GetModuleHandleA
ReleaseMutex
TlsGetValue
CreateFileMappingW
HeapDestroy
GetStartupInfoA
DeleteFileA
TlsAlloc
GetDriveTypeA
TlsGetValue

user32

IsZoomed
DispatchMessageA
PeekMessageA
GetWindowLongA
FindWindowW
DrawTextW
IsWindow
DestroyWindow
GetIconInfo
CallWindowProcW
DestroyMenu
DispatchMessageA
LoadImageA

colbact

PartitionAccessCheck
PartitionAccessCheck
PartitionAccessCheck
PartitionAccessCheck

cryptui

CryptUIDlgCertMgr

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 408KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ