JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4 | Triage

Sharing

General

Target

JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4
Size

176KB
MD5

2a6ca24fb83bed49712ee86abd8468f4
SHA1

83ea0dffae99431ea835b6ddaf391e4cafaae977
SHA256

4e81bae511b99065b28c176ea9e52b6beb95910763c6557512e2cf602661e364
SHA512

afe4150f3d3873d4b34f1588284b94b036736d9186b8164dc8406914a10942c5b25a6f9ea7990c2bcda31b22b70ba2a75c65e50f7b405b9e3999eb77ecc91373
SSDEEP

3072:OMEkbJqKLsAu9RDdQb1/JDj0nGt7XI9luYSFEHRlfxEOgC:OIbBsp/p05j0nGQlnSK3fqOgC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4

Files

JaffaCakes118_2a6ca24fb83bed49712ee86abd8468f4
.exe windows:4 windows x86 arch:x86

5d1aac0aa7e4c29b4a7718b2f4014330

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

clusapi

CloseCluster

kernel32

GetLongPathNameW
InterlockedIncrement
GetProcAddress
GetWindowsDirectoryA
SetThreadContext
MultiByteToWideChar
LoadLibraryA
DeleteCriticalSection
GetModuleFileNameA
GetVersion
EnumResourceNamesA
DisableThreadLibraryCalls
GetFileAttributesA
ExitProcess
InitializeCriticalSection
InterlockedDecrement
lstrcpynA
GetLocaleInfoA

user32

EndPaint
OffsetRect
GetWindowRect
GetDC
ReleaseDC
BeginPaint
SetDlgItemTextA
DestroyWindow
SetFocus
GetKeyState
MoveWindow
PtInRect
LoadAcceleratorsA
EqualRect
SetWindowRgn
GetActiveWindow
SetWindowLongA
CharNextA
IntersectRect
DefWindowProcA
GetDlgItem
UnregisterClassA
SetParent

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ