f82f10be0679a246ca7d4403c54f2ce0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f82f10be0679a246ca7d4403c54f2ce0_JaffaCakes118
Size

18KB
MD5

f82f10be0679a246ca7d4403c54f2ce0
SHA1

f5e38b0688aa9e35556f89a06a9d5c74ffbee916
SHA256

e1abcc330cf05c5c1d7ae15cac8e60a40fb29bc9e411d234de24efa842f89375
SHA512

7de5aa9265e8fdfac052b3cb024b5023083362717e1adf4452af2e2def67f3ae7a334640f9459a941d90d686acb10ef7b9bc81f970f9dd7342ab61147a14381e
SSDEEP

192:Nq/OYfPFeJDxXXXrorQXiqtUEy2IaZ6lJZZFj+d9mB9ZemEJtWSBgc7oI3zRvKq1:NkONCZUy7QiB9ZeNYa7z1eG4+rKoTEA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f82f10be0679a246ca7d4403c54f2ce0_JaffaCakes118

Files

f82f10be0679a246ca7d4403c54f2ce0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

72daf67628d271096a9f624a5149d0ed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadProcessMemory
GetCurrentProcess
GetProcAddress
GetModuleHandleA
CloseHandle
LoadLibraryA
GetModuleFileNameA
WriteProcessMemory
VirtualAllocEx
VirtualFreeEx
ExitProcess
OpenProcess
GetOEMCP
GetACP
FreeLibrary
Sleep
TerminateProcess
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
WideCharToMultiByte
LCMapStringA
LCMapStringW
RtlUnwind
GetStdHandle
WriteFile
GetCPInfo

user32

GetWindowThreadProcessId
MessageBoxA
FindWindowA

advapi32

GetUserNameA

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE