53d27507cd54fd2a224231fab62b9c3a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

53d27507cd54fd2a224231fab62b9c3a_JaffaCakes118
Size

16KB
MD5

53d27507cd54fd2a224231fab62b9c3a
SHA1

86058f9e00063c96b870af00670b49c9959a123a
SHA256

aaf880089243c5abd8eb7d630f98faf06a9dd293ca56c931b265dab9365ac432
SHA512

d6028e3eae24909c42a7ba44ac686ccd0a6d65f2d99b75cdd1f0efed2b245bdc670bec98590c5ceecd6f07770becd0b24fe38df28cdf5f999d46ce981ac7a8f2
SSDEEP

384:rE/ADnQ6zFsTzQWS/VIpn4w9FAzvvWaA4styTF1tsOOYKY11Hj:Q/l5J39FXtyTFIOUW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53d27507cd54fd2a224231fab62b9c3a_JaffaCakes118

Files

53d27507cd54fd2a224231fab62b9c3a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2740c2b69f17760526972685cced6caa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlInitUnicodeString
NtCreateSection
RtlUnwind

kernel32

CreateFileA
GetFileSize
SetFilePointer
FindResourceW
LoadResource
GetModuleHandleW
VirtualFree
GetWindowsDirectoryA
WriteFile
Sleep
SizeofResource
ReadFile
CreateFileW
lstrcatA
GetLastError
GetProcAddress
VirtualAlloc
CopyFileA
GetTempFileNameA
GetVersionExA
LockResource
CloseHandle
DeleteFileW
GetTempPathA
lstrcpyW
DeleteFileA
lstrcpyA
HeapAlloc
HeapFree
GetTickCount
GetProcessHeap

user32

SetDlgItemTextA

gdi32

Polygon

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ