1947f0af566e6007fdcebe655099492f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1947f0af566e6007fdcebe655099492f_JaffaCakes118
Size

240KB
MD5

1947f0af566e6007fdcebe655099492f
SHA1

a6bc9805e8e15c5185dd845b8acc43f6369cefc5
SHA256

69f08e2ac6ad02f392b0e525833e90fa73b59ca5e1c5b70da40de0f3ab3e71c1
SHA512

9c12e4e1f820949340be394b4097a1253fbfa2010eb25cce1476da12ac48ec83ffc3b4cd40784aa3224fdd0c491e9ac6490ae9b68dbfb352a0dd5a79ca229cd0
SSDEEP

6144:NEwrmb9RUuBbtm6gO+jJZZorPRP25UgZ6CrnpsxxS766T81MPFt:NEwrmpRUuuXl+t61D+S7LQ12t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1947f0af566e6007fdcebe655099492f_JaffaCakes118

Files

1947f0af566e6007fdcebe655099492f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ecc33d7d0fadc4a6795ee8aa0d429a91

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DisableThreadLibraryCalls
OpenThread
OpenMutexA
GetStringTypeExA
CreateDirectoryExA
GlobalUnfix
AddAtomA

user32

ChildWindowFromPoint
GetThreadDesktop
LookupIconIdFromDirectory
CreateDesktopW
GetUpdateRect
SendMessageW
FrameRect
GetKeyNameTextA
CharNextExA
EnumWindows
DeferWindowPos
DdeCmpStringHandles
SetClassWord

gdi32

EqualRgn
ExtCreatePen
GetBoundsRect
StartDocA
TextOutA
PolyTextOutW

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 796B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE