JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92 | Triage

Sharing

General

Target

JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92
Size

191KB
MD5

bccfd3da9ad7b5d7626f8aca5858ab92
SHA1

1069027bfac1e999a6bca89c8591dda559d376a9
SHA256

9cc81930049966f8bb3e904d31ee7d02e4ed16b28b2ac8f36f4b8a07c37af19b
SHA512

1ba10730705ff6793517b55c9551096491c11493880acf14bb6477a3b9b1ba435f58b6de84bfe159d14d6cf59e7941c1d3d4bb6dac3ae2420b4ce4f2a2f75139
SSDEEP

3072:CQjblh10LCvYbZkXxIkE9lseNugkXvs/mJDjIOJGhC21TgKnO:CQjBh10LCvYNBkE9KeNLk/nWEq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92

Files

JaffaCakes118_bccfd3da9ad7b5d7626f8aca5858ab92
.exe windows:4 windows x86 arch:x86

a7aea01ea9971a5a496b62640e2036e3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmAssociateContext

ole32

GetHGlobalFromILockBytes
CoTaskMemFree
StringFromGUID2

kernel32

CreateFileW
SetProcessPriorityBoost
CreateEventW
GlobalAlloc
TerminateThread
GetModuleFileNameW
DeleteCriticalSection
EnumResourceTypesA
CreateProcessW
Sleep
WriteFile
GetVersionExW
InterlockedDecrement
ReadFile
GlobalLock
GlobalUnlock

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 652B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ