29f900c045d3ddf19fbef8bc555e0a90_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29f900c045d3ddf19fbef8bc555e0a90_JaffaCakes118
Size

696KB
MD5

29f900c045d3ddf19fbef8bc555e0a90
SHA1

bb47be16bfb584261e6b80e648c02f2ef96ca257
SHA256

df9e8fac113042cb7a9c2de8e7808a8b31a298408aea9fb7d82849a718a94e91
SHA512

85dd5c5f31b32eb4d172772a4ddb4742b9bea07b12bd18046e2b439ee7516dd1531aa533b5917e123f325a5547dc18def4e577e5cc449f5a3674bd4d473b08c3
SSDEEP

12288:gcUk9EIdjJ28OssuZWj1W1v2xehk0Xrj1kRiWuoe6p2d/NegBKR:gc9Ldl28OssuZkW1v2xwk0bZkEWJrGe3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29f900c045d3ddf19fbef8bc555e0a90_JaffaCakes118

Files

29f900c045d3ddf19fbef8bc555e0a90_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f75168d64597984c5fdae1cdd5162476

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
GetVersion
GetFileSize
LocalAlloc
GetCommandLineA
LocalFree
GetModuleHandleA
GetStartupInfoA
Sleep
lstrlenA
lstrcpyA
CreateEventA
GetTickCount

msvcrt

_exit
exit
wcstoul
memmove
_c_exit
__p__commode
_XcptFilter
__CxxFrameHandler

gdi32

GetObjectA
MoveToEx
GetTextColor
GetStockObject
GetTextExtentPoint32A
CreateFontIndirectA
BitBlt
ExtTextOutA
GetBkColor
DeleteObject
GetPixel
SetBkMode
SelectObject

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 673KB - Virtual size: 676KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 724KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ