f89454645dd0f8fba3b108672bbfce5e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f89454645dd0f8fba3b108672bbfce5e_JaffaCakes118
Size

189KB
MD5

f89454645dd0f8fba3b108672bbfce5e
SHA1

1e61c941f2196ed435214839e83970543a145e00
SHA256

cfee161cd9cc22ad1b8f33cba8c5f5e4a46f2577dfb6abe3d0049e63d928e192
SHA512

c1048d2f89a5eb608fb2a20f833226031d94f5bb497d6c555b067d1fa6094510be6fef02dfd69fc0dabb8ee3683987b9d0b0012420b51b3408a923013a521780
SSDEEP

3072:rdMoJMNMa8F2lsy+NO/fanaRzb8uAxIGt+dLEoog5smyRUU:5Moi8F22NO/Ou85xsLzog5N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f89454645dd0f8fba3b108672bbfce5e_JaffaCakes118

Files

f89454645dd0f8fba3b108672bbfce5e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbb1cc522575c5acaf44d31630829c83

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentProcess
WaitNamedPipeA
VirtualProtectEx
ExitProcess

user32

DestroyCaret
GetActiveWindow
GetWindowLongW

Exports

Exports

IsEaotelwf

Sections

.itext
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.lmi2l1
Size: - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lmi1l1
Size: 181KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ