41ef24a880987a7ee3b924a15fb749a1_JaffaCakes118 | Triage

Sharing

General

Target

41ef24a880987a7ee3b924a15fb749a1_JaffaCakes118
Size

131KB
MD5

41ef24a880987a7ee3b924a15fb749a1
SHA1

b68af817ad8ee631f9a547294f36a9ae3ac61d80
SHA256

babfae3b90783f8ee67714d904f7ac76c97773ec610253bac03985498a6fdfa6
SHA512

90aa46bbab18a610ef640f31ee911e73afe3d3b12941d3209ad88913a7d482271c9edd2c407b6bcd77591378c06dacec2ec565098768c24e183acbb872ed7539
SSDEEP

3072:UqTNVPDluV6aNL+M3JoMiz/lBIwV/AuRwi/xT2n6dnY6JK:rNlDIsUL+M3Jqj7IwBRH/xT5Y6JK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41ef24a880987a7ee3b924a15fb749a1_JaffaCakes118

Files

41ef24a880987a7ee3b924a15fb749a1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

05649f993831e74ad755baecb606b33e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ole32

CoUninitialize
StgOpenStorage
CoFileTimeNow
CoCreateInstance
CoInitialize

occache

FindControlClose

shell32

SHGetSpecialFolderPathW
ShellExecuteExW

kernel32

LockResource
GetCurrentProcess
GetSystemInfo
ReadFile
CreateFileA
FindNextFileA
MapViewOfFile
SetEndOfFile
FindResourceW
LockResource
GetTempPathA
SizeofResource
GetModuleFileNameA
EnumResourceNamesW
ExitProcess
FindClose
VirtualQueryEx
UnmapViewOfFile
FindFirstFileA
SetFilePointer
CreateFileMappingW
GetFileAttributesA
CloseHandle

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 1024B - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ