JaffaCakes118_0624ab543750b24a452d8564426a368a | Triage

Sharing

General

Target

JaffaCakes118_0624ab543750b24a452d8564426a368a
Size

276KB
MD5

0624ab543750b24a452d8564426a368a
SHA1

0f1e32bd73713397604bce6dbcc130e4391b1888
SHA256

1f6967d2b9a8ae24f5d8a44bd0c937b969eacb043a63986c45d599dc4d5ddfb8
SHA512

e25e441691a46af6c2b047e531e4bea71e28af5446219fb5b58b3723c14782ceca31107665b5d4caf87167b7000a3a800343314b7f2443e4cb3d65cfb6290be7
SSDEEP

6144:IhfAIAwdWYVPNQhxGe6AR4KWyZxeuedVMzjd5lI5IAs0lkF5ebS:pIRdBPqzX4sj5yyzjdPSIV0l25

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_0624ab543750b24a452d8564426a368a

Files

JaffaCakes118_0624ab543750b24a452d8564426a368a
.exe windows:4 windows x86 arch:x86

f414e1e06809c9d5d736419cfe4e0810

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapCreate
AddAtomA
GetFileType
FreeEnvironmentStringsW
TlsSetValue
SetHandleCount
GetEnvironmentStringsW
GetStartupInfoA
IsBadWritePtr
TlsGetValue
HeapSize
FreeEnvironmentStringsA
SetLastError
InterlockedExchange
GetStdHandle
VirtualAlloc
EnumResourceNamesA
GetCurrentProcess
SetEndOfFile
GetSystemInfo
TlsFree
GetVersionExA
IsBadStringPtrW
GetLocaleInfoA
GetEnvironmentStrings
TerminateProcess
GetModuleFileNameA
VirtualFree
GetACP
TlsAlloc
UnhandledExceptionFilter

winmm

mciSendCommandA
sndPlaySoundA

setupapi

CM_Get_Depth
CMP_WaitNoPendingInstallEvents
SetupDiGetDeviceRegistryPropertyW
CM_Get_DevNode_Status

shlwapi

PathAddBackslashA

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ