ec80449c3684cc69d389b0e72f8b8246_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ec80449c3684cc69d389b0e72f8b8246_JaffaCakes118
Size

17KB
MD5

ec80449c3684cc69d389b0e72f8b8246
SHA1

febca006fa08aacaf30af997c839540c3653447e
SHA256

9220efddcc8332c26f85173464dde389d49773d385455d2e0aaabef4a15d1b00
SHA512

4b36146f2bf5252f82201cb4f16e8c621800482db4637446cf2dc104d6c59391281ad0e5a8feef93f12523f969473a435c9729ed26bc8927403e5e519e640949
SSDEEP

192:CvYY+fOPqq96smZL/xsLJz7H0voRwIl2Z9+sTAdql01c/rOX90qevv4EQnB0/0:U+fOSq6T1Js2BI48s/Hrg9ygEHs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ec80449c3684cc69d389b0e72f8b8246_JaffaCakes118

Files

ec80449c3684cc69d389b0e72f8b8246_JaffaCakes118
.exe windows:5 windows x86 arch:x86

fa8560b3dd08ee001893e0edd10c4665

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
UnhandledExceptionFilter
RtlUnwind
SetUnhandledExceptionFilter
ExitProcess
GetWindowsDirectoryA
lstrcatA
CreateFileA
VirtualAlloc
GetProcessHeap
TerminateProcess
IsDebuggerPresent

user32

TranslateAcceleratorW
LoadCursorW
GetDlgItemTextW
EnableMenuItem
DefWindowProcW
UnhookWindowsHookEx

comdlg32

GetOpenFileNameW
FindTextW
CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
ChooseFontW

advapi32

RegOpenKeyExA

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ