177244bfb4cfba9ca1d9c9a852a2c680_JaffaCakes118 | Triage

Sharing

General

Target

177244bfb4cfba9ca1d9c9a852a2c680_JaffaCakes118
Size

121KB
MD5

177244bfb4cfba9ca1d9c9a852a2c680
SHA1

6a297b09ad00cb261b509d3681c91ffaeec954b0
SHA256

093c5c655c6c0ce094fd40180ea2256199ff3b0a641c87626c3e6efe5b28615a
SHA512

fbb9d2c004f9f825ca96f446926192d7e405d26f74c12fd7167167b8032e656beac0e86313d717089df162bf0719b7cd2a9273a13551fad5eb743cbfb89a5f0b
SSDEEP

3072:TM+eF26PYMSW7bv8abweHauKp4Z7srbgeQAxux:TM+QLNSW7bUNMaR0qnQAxo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
177244bfb4cfba9ca1d9c9a852a2c680_JaffaCakes118

Files

177244bfb4cfba9ca1d9c9a852a2c680_JaffaCakes118
.exe windows:5 windows x86 arch:x86

babef9e006969daeb5803b5f869de778

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDiskFreeSpaceW
InterlockedIncrement
WriteFileEx
lstrcpyW
GetDiskFreeSpaceW
LoadLibraryExA
Sleep
GetFileAttributesA
GetPrivateProfileSectionA
FindResourceW
GetLongPathNameW
GetExitCodeProcess
CreateDirectoryA
lstrcmpA
GetPrivateProfileIntA
LoadLibraryA
GetPrivateProfileIntA
HeapCreate
SetEnvironmentVariableA
Sleep
WaitForSingleObject
InterlockedDecrement
Sleep

apphelp

SdbDeletePermLayerKeys
ApphelpCheckIME
ApphelpCheckExe
AllowPermLayer

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.clx
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ