56ab3083893799d1853ae5984b41c30c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56ab3083893799d1853ae5984b41c30c_JaffaCakes118
Size

174KB
MD5

56ab3083893799d1853ae5984b41c30c
SHA1

347ab0838e49814991636bb65b1ee1acf79691c1
SHA256

9bade0790ed36b0fea7e153eabc16519a8bd6943f995b33f82aede9f5aa13513
SHA512

b04b310ace21fec6aaf682af0d7933d4aa6674635ed3f331f25995f73beb1aaf2a8cb2cf37474380ed113eeb49c3ec7cd684df2b40be6d5dea59b64eb2abce3e
SSDEEP

3072:WqTuucHkRiHAaRROhmXgwre3r47kVb3b0K1/FFtsjJSnRZNfXm6jkJMzZ:WqinERxaPOSVr0r4sb3bh1tFtTRnXhjF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56ab3083893799d1853ae5984b41c30c_JaffaCakes118

Files

56ab3083893799d1853ae5984b41c30c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3fcacade2a5fdc570b095d1f46ebad75

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

clusapi

CloseCluster

user32

EnumDisplaySettingsW

comctl32

InitCommonControlsEx

kernel32

GetCurrentThreadId
ReplaceFileW
TerminateProcess
Sleep
GetProcessId
IsDebuggerPresent
InterlockedCompareExchange
GetTickCount
EnumResourceTypesA
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
ExitProcess
InterlockedExchange
QueryPerformanceCounter
UnhandledExceptionFilter
GetCurrentProcess

shell32

ShellExecuteW

Sections

.text
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ