9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118 | Triage

Sharing

General

Target

9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118
Size

136KB
MD5

9f0af9631cf52ffee2c6d6a424866883
SHA1

4cc6c30373c06517544cb8147d0f070d28b0594e
SHA256

d9aaf683f718686b3770bc597784aeee0d7dc81a418df3e6404f2ee5b6bb006b
SHA512

a9a348665d4a61e099b45790612b6d461030a837f449ed537d1e43919454cfcdf69349abbc49bf2960e4500770aaf2cf4b49871058af1128e3e65944e681eb5b
SSDEEP

3072:fP7kEDyliVWhD0nVLxfufrUgEywaD9PTYOEZ6prEsgOl:fzkEDyliV1yEDgTY16prWO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118

Files

9f0af9631cf52ffee2c6d6a424866883_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c3bc9a0b591a02073f13cca413a597fc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SetTimer
KillTimer
PostThreadMessageA
CharUpperA
GetMessageA
PeekMessageA

rpcrt4

RpcBindingSetAuthInfoA
RpcStringBindingComposeA
RpcBindingFromStringBindingA
NdrClientCall
RpcStringFreeA

kernel32

ClearCommBreak
GetStartupInfoA
ClearCommBreak
QueryPerformanceCounter
EnumResourceNamesW
ExitProcess
CreateProcessW
ExitProcess
GetExitCodeProcess

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 684B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rscr
Size: 512B - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ