3782467a888d6a8e1151c3f21651f08c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3782467a888d6a8e1151c3f21651f08c_JaffaCakes118
Size

96KB
MD5

3782467a888d6a8e1151c3f21651f08c
SHA1

f20587ed56a80335b9696ae3de483be0d896ef5a
SHA256

ca14ac5582a3e97c1868e39f915d669e2dca3fe8b2d6f817a7c38a2a95c94794
SHA512

bf2b9ee60e92a6ecdbc2448e64c781a346d9ba67c852a14a6e31188d012eca70db39887e61ea1ea48186fe689fe26e0008f9724fd8811dbaae068278998587d9
SSDEEP

768:NfObqnSzmpH9GE925OrmaNctd1zSLOqMdlVKveSLMm+EbCLb3rx8spUVYmfOV:NfObqnUm19GEUydLOqMdWv2m+azspOy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3782467a888d6a8e1151c3f21651f08c_JaffaCakes118

Files

3782467a888d6a8e1151c3f21651f08c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0aad496f7065898d655c1e5a0cfd537f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\temp\mboutg.dbg

Imports

kernel32

GetTickCount
GetLastError
DeleteFileW
Sleep
VirtualFree
CloseHandle
GetModuleHandleA
WriteFile
GetThreadPriority
GetProcAddress
VirtualAlloc
RtlUnwind
LoadLibraryA
GetCurrentProcess
TerminateProcess
HeapReAlloc
HeapFree
ExitProcess
HeapAlloc
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA

user32

EnableWindow
LoadBitmapA
SetFocus
DestroyWindow
SendMessageA

ws2_32

send
select

Exports

Exports

?XM2LPARSE@@YAKK@Z

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.const3
Size: 4KB - Virtual size: 46B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ