04e8a1422b1002332d2078c8ab5008fa_JaffaCakes118 | Triage

Sharing

General

Target

04e8a1422b1002332d2078c8ab5008fa_JaffaCakes118
Size

89KB
MD5

04e8a1422b1002332d2078c8ab5008fa
SHA1

ddd9ddb8bcbc730a2aaaf09551b05a0731aebbb5
SHA256

cc7c3936e486941d09aeffe28827d7d75c225d47c3e5e4d152dd46995e6ffcad
SHA512

4229dd938a6341df02aa9adce782603e01562092c8dff95d76b4db40e2a6828e9fc8ed4793e8dbd1923126fe938863eb7a17a30ff57f627af34195ffc5e0309a
SSDEEP

1536:E2obUUjPDx1JpWPPKCAvnbAaIJZjIBvsR:ejPDyKNvbAaIPBR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04e8a1422b1002332d2078c8ab5008fa_JaffaCakes118

Files

04e8a1422b1002332d2078c8ab5008fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7813a140e74298df1efca63c8c012681

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualProtect
GetTickCount
ReleaseMutex
FindAtomA
GetModuleHandleA
DeleteCriticalSection
GetDiskFreeSpaceA
CloseHandle
GetLastError
CreateThread
SetEvent
FindVolumeClose
FindClose
ExitProcess
lstrlenA
FindResourceExA
Sleep
GetConsoleFontSize
TlsGetValue
SearchPathA

user32

CloseWindow
IsIconic
CopyImage
EndDialog
CreateMenu
GetScrollBarInfo
DispatchMessageA
CreateWindowExA
GetMessageA
DialogBoxParamA
CopyIcon
DragDetect
GetKeyState
EnableWindow

wshbth

WSHIoctl
NSPStartup
WSHJoinLeaf
WSHOpenSocket2
WSHNotify

advapi32

RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 522B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE