f678dd5be7b2b4f3da03150971e916f5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f678dd5be7b2b4f3da03150971e916f5_JaffaCakes118
Size

238KB
MD5

f678dd5be7b2b4f3da03150971e916f5
SHA1

0b67e7fee017e689bf5ba42bca373b1a5fbfb4ab
SHA256

7f27fec28b465223237f179d1a00b621b4598ddf599e5b08e8724bf8d41099ca
SHA512

fb6955541a7c1e8732977f72e9cae54320a1988cacf1ac2306061f8f676f75262bac99b0a7e37104a88cfda79badaa357893c2b5509f1b110346be1924b0fffe
SSDEEP

6144:gbi5/Ptiuqt3KP/062Hd2D9kmh5+cxoCAN8MrXFQkVffZ7h3rgo3CLvD4:gOHLPMDC9kmhXKqMTmujr93CH4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f678dd5be7b2b4f3da03150971e916f5_JaffaCakes118

Files

f678dd5be7b2b4f3da03150971e916f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8a8256941f642d7feba57cf5557a2d05

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
VirtualAlloc
Heap32First
Heap32Next
WriteFile
GetEnvironmentVariableW
Heap32ListFirst
Sleep

user32

PostMessageA
GetMessagePos
GetInputState

ole32

CoUninitialize
OleInitialize
CoInitialize
CoInitializeEx

advapi32

RegQueryValueExA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE