18b0b7c25ec34de75b00eb6e937ee8d7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

18b0b7c25ec34de75b00eb6e937ee8d7_JaffaCakes118
Size

42KB
MD5

18b0b7c25ec34de75b00eb6e937ee8d7
SHA1

18f22afc063f2bf433de74786a128756b003e97d
SHA256

782899a4e86e85fdfc2796ef08b4c61eb1ccb9a3ebaf96c7028c64da410db2d8
SHA512

4a989182e9a88d3f59ed55ad03bd1ce53fad1726bde8e3b6f3d0208a14ddb231b489f3187936409ba7ebeabfba5bb60918242037e39263c0ea1697f027243e7f
SSDEEP

384:itu2h5OeCmNcdj7Seau9nolGFGoDJo0b45Z6LbMW2r:it5514t+e3SGFGcz4ubn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18b0b7c25ec34de75b00eb6e937ee8d7_JaffaCakes118

Files

18b0b7c25ec34de75b00eb6e937ee8d7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ab563389cf179dd54715b17d2a3b0cf2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

SetBkColor
SetTextColor
GetStockObject

user32

SendMessageA
RegisterClassExA
PostQuitMessage
MoveWindow
MessageBoxA
TranslateMessage
LoadCursorA
GetMessageA
GetCursorPos
DispatchMessageA
DefWindowProcA
CreateWindowExA
LoadIconA

kernel32

lstrcatA
WriteProcessMemory
VirtualAllocEx
Sleep
SizeofResource
SetThreadContext
RtlZeroMemory
ResumeThread
ReadFile
CloseHandle
CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
GetThreadContext
LoadResource
LockResource

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE