856df06e90b7e1967b86a4c5015391f7_JaffaCakes118 | Triage

Sharing

General

Target

856df06e90b7e1967b86a4c5015391f7_JaffaCakes118
Size

152KB
MD5

856df06e90b7e1967b86a4c5015391f7
SHA1

86ada86adfe1c8ab246ac597e7f0f525078613b9
SHA256

287c59dd729dc5e2748352e08fff9d2104f281071b67fc5b6187bdbc00f94a95
SHA512

936ae80e6b24d83407b3d9d3f6d80505543dab533b2f19bd79391d7ba5a7219b08e30782621156bc791fb1a671e0bbed72d991f5a29d314d2fa2d795c8b868d0
SSDEEP

3072:Pk+bxTZzE8BUa/jmz0WIm61uis+lChjrW4pu1xh+rz+u+ZdX:Pk2TZzDUAqz0WIV1LiUxh+WpXX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
856df06e90b7e1967b86a4c5015391f7_JaffaCakes118

Files

856df06e90b7e1967b86a4c5015391f7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d75ad28949e5eb8d613212c25b82b88f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memmove
memcpy
strncpy
strlen

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
LoadLibraryA
CloseHandle
GetCurrentThreadId
GetCurrentProcessId
HeapReAlloc
HeapAlloc
HeapFree

user32

MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos

comctl32

InitCommonControlsEx

ole32

CoInitialize

Sections

.code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ