18f434a4c399448a0b33a3706df31fa6_JaffaCakes118 | Triage

Sharing

General

Target

18f434a4c399448a0b33a3706df31fa6_JaffaCakes118
Size

23KB
MD5

18f434a4c399448a0b33a3706df31fa6
SHA1

253e69269051a68cfe7fbaa8d4cf51bfe98304b7
SHA256

ed2a92b6d604e1890151d2e8f4ff70451b067b4c9f5da317e46cf8e0d5a2e9df
SHA512

2a0f485b493f9e61cabc4c7c62b003f9a20fed6555b7406407075cc3921ca11667fda2f45a281f0a9831f8366a129a173f21a252effab2529fb028de01a6bec6
SSDEEP

384:D/jeD2ugFirE2RTwnpXtp+bSV5WNHWR9+EMQIa:beSiJTwbYlY9lUa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18f434a4c399448a0b33a3706df31fa6_JaffaCakes118

Files

18f434a4c399448a0b33a3706df31fa6_JaffaCakes118
.exe windows:5 windows x86 arch:x86

11ccb4e69b1279ecabec8d9d7ccbf149

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc

msvcrt

memcpy
memset

user32

CreateWindowExA
LoadIconA
LoadCursorA
RegisterClassExA

gdi32

GetStockObject

advapi32

RegOpenKeyExA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text2
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ