164eb96b78527b71640125c5cb9dadd8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

164eb96b78527b71640125c5cb9dadd8_JaffaCakes118
Size

84KB
MD5

164eb96b78527b71640125c5cb9dadd8
SHA1

7a5befb31456d829f108a6b938a689fb8f28d255
SHA256

275d79521c2625b03915d189f1974c4c688891e771adab340b849d7c2e829c9c
SHA512

4eec566f1abca78261eec5200a7170d7eabc3a230851947017fab4b2e45aeb4e42af567f0f32c715c5f3ff46177ca6f6a1f3345cbad27a18635be3aab645a7d4
SSDEEP

1536:3sHv91cIOtMnToIf7m7+7mTrngJElRI+jhtD+u76x:gvPStgTBf7A+7m/gJSjXKu7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
164eb96b78527b71640125c5cb9dadd8_JaffaCakes118

Files

164eb96b78527b71640125c5cb9dadd8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

60f1bcf3282e0a01e16db51b4b9512b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
lstrcmpiA
VirtualAlloc
IsBadReadPtr
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetStartupInfoA

user32

DefWindowProcA
SetTimer
GetMessageA
DispatchMessageA
TranslateMessage
KillTimer
SendMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA

msvcrt

_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
malloc
_beginthread
free
_exit
exit
_acmdln
__getmainargs

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE