26f22bde7b6249f9f7432b2127d12897_JaffaCakes118 | Triage

Sharing

General

Target

26f22bde7b6249f9f7432b2127d12897_JaffaCakes118
Size

36KB
MD5

26f22bde7b6249f9f7432b2127d12897
SHA1

77ef78e959e9b652eacfc63fe89506f0c3f1effa
SHA256

71940d0e1cddc4f0e9909bd8a4ad190e48f2e3c0e7362b1ee8b84f6a28364393
SHA512

d4a56629978774ac03256c9a89bcd4cf822c5caadbaab3344674c607887ff67ff3180084a122a5bf1337061bdc97774208b082af3e973e2938679d0daefaada1
SSDEEP

384:bmve+Zftn1e291u96WhUSOwWzgJ9eiiaHNNDRrp:bmzZFn1HDu9jjaUVT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26f22bde7b6249f9f7432b2127d12897_JaffaCakes118

Files

26f22bde7b6249f9f7432b2127d12897_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c12ccd7e79aa550339fdb5eeb8875b3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecW

mfc42u

ord800
ord537
ord858
ord925
ord942
ord825
ord538
ord535
ord823
ord940

msvcrt

_initterm
__setusermatherr
__getmainargs
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
exit
_XcptFilter
_exit
__CxxFrameHandler
wcscmp
_adjust_fdiv
_acmdln

kernel32

GetStartupInfoA
GetModuleFileNameW
CreateFileW
CloseHandle
Sleep
GetExitCodeProcess
GetModuleHandleA
GetLocaleInfoW

user32

MessageBoxW

shell32

ShellExecuteExW

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE