4495b549e1db60d309938787414d16e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4495b549e1db60d309938787414d16e4_JaffaCakes118
Size

134KB
MD5

4495b549e1db60d309938787414d16e4
SHA1

810d001b44eb5dd3c1372a6193383dae9678df73
SHA256

6dac97331cb5af7ca785d91438fc0b18a7ac9f9d5fb38b123f4e543740dc4b5b
SHA512

3d2e4e5d86448202d6efea60ec17748832766feebe22c39595ad2c0bf07209de5f898833f60121f38cad1572bd3d98fb5ac35636109cdb3193fd99670c9966de
SSDEEP

3072:6tvDXj1K2diSchRlBn/hV4kMPGH6Cw0SFA8krz:662diSaBJsPGHT6u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4495b549e1db60d309938787414d16e4_JaffaCakes118

Files

4495b549e1db60d309938787414d16e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

082fa97f96fbe95a37291448f7f85ec2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InterlockedIncrement
IsDBCSLeadByte
IsDebuggerPresent
LoadLibraryA
OutputDebugStringA
VirtualAlloc
VirtualFree

user32

CreatePopupMenu
DrawTextA
GetClassInfoA
GetClientRect
GetParent
IsWindow
LoadCursorA
MapWindowPoints
ReleaseDC
TrackPopupMenu

gdi32

CombineRgn
CreateBitmap
CreateCompatibleDC
CreatePen
CreateRectRgn
LineTo
PatBlt
SelectPalette
SetBrushOrgEx
SetEnhMetaFileBits
SetViewportExtEx

shell32

CommandLineToArgvW
DragQueryFile
SHFileOperationW
SHGetPathFromIDList
SHGetSettings
ShellExecuteW

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ