00528dfef8b3a024d71783816afbd334_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

00528dfef8b3a024d71783816afbd334_JaffaCakes118
Size

7KB
MD5

00528dfef8b3a024d71783816afbd334
SHA1

99751d5017f313f1e30af999cc75b5a028a1813a
SHA256

40ba455bccfb6a2b1c536ea9a42824242968bec694c27a0dad60de6296ddd212
SHA512

3b557c3c7a6db91aaf9d5658ac5615a4658e1d4d67ca91d2a393f769d0fa9228c060c646091cae31e2d6706e07c5544c529c6ef2281166fe0c4450aabfb01aff
SSDEEP

96:p680PuPTyFBiuZndUUcM3epMhSKjjac171XaNbO11Sy3Lds9SySeuv/vc:imTybUvGepM8Kj/XaJO77ds9Seuv/v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00528dfef8b3a024d71783816afbd334_JaffaCakes118

Files

00528dfef8b3a024d71783816afbd334_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f605c6d7036bad68715ff323f7e511bd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
lstrcatA
GetProcAddress
ResetEvent
SetEvent
GetModuleHandleA
GetCurrentThreadId
CloseHandle
lstrcpyA
GetModuleFileNameA
VirtualQuery
InterlockedExchange
ExitProcess
CreateEventA
LoadLibraryA
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
FreeLibrary

user32

GetTopWindow
IsWindow

advapi32

RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE