2d3896d9397adf66570962eaa4ff78a0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d3896d9397adf66570962eaa4ff78a0_JaffaCakes118
Size

150KB
MD5

2d3896d9397adf66570962eaa4ff78a0
SHA1

21b29ef0c11ae6a39cfc1829c14631ea3169d26f
SHA256

f58417185b4c1efee95d46a8df261e196d1920c7a0cf9ba74c70e1d20bea0053
SHA512

ea39af6e741021200c518d43b598a3d727335bfea2a573aa4e478c1d71d8bb257132e5a7a51b6e004c270e091ccc29dc4454b2f0514d4acc0191d14688bd4113
SSDEEP

3072:rp66KYIO9weCbIsNE0vHCJXnqns4Bm2FNTOpx:rs6N9we7KxWXT4Bm2Fi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d3896d9397adf66570962eaa4ff78a0_JaffaCakes118

Files

2d3896d9397adf66570962eaa4ff78a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b673ae4bbb5eb691d40f727cd7f1307e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoW
GetCommandLineA
RtlUnwind
GlobalFlags
GetModuleHandleExW
GetEnvironmentStringsW
GetProcessVersion
GetProcAddress
SetLastError
GetLastError
FreeLibrary
lstrcmpiA
lstrlenA
GetModuleHandleA
GetVersion
GetModuleFileNameA
InterlockedDecrement
lstrcatA
SetErrorMode
LocalReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentVariableA
LocalFree
GetVersionExA
FreeEnvironmentStringsW
LoadLibraryA

shell32

ShellExecuteExW

shlwapi

SHDeleteKeyW
PathCombineW

ole32

CoRevokeClassObject
CoQueryProxyBlanket
CoRetireServer
OleIsCurrentClipboard
OleInitialize
CoFreeUnusedLibraries
OleUninitialize

Sections

.text
Size: 55KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 306B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ