0481af494e6fc703b39eac506af476f9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0481af494e6fc703b39eac506af476f9_JaffaCakes118
Size

54KB
MD5

0481af494e6fc703b39eac506af476f9
SHA1

a188c36948d79008d7e62602cb7c40f5e6ec655b
SHA256

a4d3317d1200c8a8170d6f643826394c3f74147fdfec9109794b80394f84d570
SHA512

28246fde4bafb9e4a01b465bb28dc82c5a9d2094a2e333e9d940b9dee36928f76ee0739fb286c30ce48f65c325b0f6ac3cebd93538932cf16a4f33e4db950c4f
SSDEEP

768:m/fnAa0gev9MX79KCYL6/I+7sfN6Ke8aySb+pYx28o2MiM5bz6ipv3Syj:kIWevCLSLO7Y6Kn7i+p1Ewz606yj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0481af494e6fc703b39eac506af476f9_JaffaCakes118

Files

0481af494e6fc703b39eac506af476f9_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1dec56f5f9d700341052b88d54b1f41c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

DuplicateTokenEx

kernel32

CreateThread

shlwapi

PathCombineW
PathFileExistsW
PathMatchSpecW
SHDeleteKeyA
StrStrW
wnsprintfA
wnsprintfW

user32

GetClassNameA
GetClipboardData
GetIconInfo
GetKeyboardState
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
MsgWaitForMultipleObjects
OpenWindowStationA
PeekMessageA
SendMessageA
SetProcessWindowStation

Sections

.ihqtgv
Size: 44KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jmdal
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vix
Size: 6KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ