1164856314c2d1945a0e7979ed8668a9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1164856314c2d1945a0e7979ed8668a9_JaffaCakes118
Size

183KB
MD5

1164856314c2d1945a0e7979ed8668a9
SHA1

66cc6ae8eecc8c1c9fbc6b3706f770764acf3560
SHA256

a26da44a275abfc4b6daa89ca0e19da292cac34efef4ce4944eb4db5bf68bd3d
SHA512

79d2efdc2c00f176570be02ff33b5144e518cf46e8dc441a50cb9c6e2cf0a59f27c490eec347515993db4aab0f08f467d28fe55ef22c61d5e33e452dc3a96318
SSDEEP

3072:jvoyTz6sco+/v4aCUaulGt5KZuRS+PsKN2XHXLp6sWH:jgrJv4zQpZuRS+PsKN2nLEs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1164856314c2d1945a0e7979ed8668a9_JaffaCakes118

Files

1164856314c2d1945a0e7979ed8668a9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

94064bb105b3557e813e6f678a1359db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
LoadLibraryA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleA
lstrlenW
GetEnvironmentVariableA
InterlockedExchange
RaiseException
WideCharToMultiByte
MultiByteToWideChar
CreateProcessW
lstrlenA
GetSystemTimeAsFileTime
GetCurrentProcessId

rpcrt4

RpcStringBindingComposeA
RpcStringFreeA
UuidIsNil
RpcBindingFromStringBindingA
RpcBindingFromStringBindingW

shell32

ShellExecuteExA
SHPropStgWriteMultiple
ShellExecuteW
SHGetSpecialFolderPathW

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ