20634b0d4225cd3d911daf828cb6aa39_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20634b0d4225cd3d911daf828cb6aa39_JaffaCakes118
Size

120KB
MD5

20634b0d4225cd3d911daf828cb6aa39
SHA1

d396236df73c7d15cf910d6ce3ff4bb75d7e1ebe
SHA256

35396cd9c37aef5c360393e391bbb2acb4956c948e2d061705728002edc068c1
SHA512

5485eea7b0b1f97c3384607c84e71a6a795653f5d802c8269c134a8f4596f5971334893282ade9e8e5f4765b8919793f74147155595ef27b24b7d7d371898668
SSDEEP

3072:Dl780tzYUtG2t+jEcW6slZor/Hsd2iwogEtgN:De06wsAZaH99

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20634b0d4225cd3d911daf828cb6aa39_JaffaCakes118

Files

20634b0d4225cd3d911daf828cb6aa39_JaffaCakes118
.exe windows:5 windows x86 arch:x86

94c036b7132f046797f2549f9bb50948

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

GetUserNameA

kernel32

GetComputerNameA
GetCurrentProcess
GetCurrentThread
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentThreadId
GetVersionExA
SuspendThread
WaitForSingleObject
CreateMutexA
GetCurrentProcessId
Sleep
CreateEventA
GetTickCount
GetCurrentDirectoryA
GetTempFileNameW
CopyFileW
GetTempPathW
GetLastError

user32

GetActiveWindow
GetForegroundWindow
GetSystemMetrics
PostMessageA

msvcrt

memset
malloc
free

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE