f206884ccce1f91f94366c646bbe03e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f206884ccce1f91f94366c646bbe03e4_JaffaCakes118
Size

7KB
MD5

f206884ccce1f91f94366c646bbe03e4
SHA1

c0cdc4e46a662fb162b0ae20bd221073b7bd72d5
SHA256

0905ef6974a312057af4d769d1078c7fa13b0cf51f6a417c496b734344b37456
SHA512

cbda304089c19ff9e6d3acf2934569797fc8eb9543a6425e8ffb4f1ed4a72043ee37538e9c05618eb365d1087b68c26658049b9d45537c850c48032340ea6280
SSDEEP

96:S/l+x7HrSwZdcyM3AnC5E4KSjajvNzYchp0jr3y1M9HVCyI26r/vcOmi:A+x7L9cyGPvKSGv+Sp0jLyE7I2+/v8i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f206884ccce1f91f94366c646bbe03e4_JaffaCakes118

Files

f206884ccce1f91f94366c646bbe03e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2876c24cd7cf9767f16b197cafef21a6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
GetModuleFileNameW
lstrcpyA
VirtualQuery
InterlockedExchange
lstrcatA
CreateEventA
WaitForSingleObject
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
CloseHandle

user32

CloseWindow
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE