1ba0bc5906de4df130ef9c2b02fea8fd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1ba0bc5906de4df130ef9c2b02fea8fd_JaffaCakes118
Size

201KB
MD5

1ba0bc5906de4df130ef9c2b02fea8fd
SHA1

49768cbe31b72f5b41160da75f5068edf2532c7f
SHA256

d6ae0739f367fbdb2e5e520d86d27c3c98f6d2181a2cfcb718b69a34b44cf0fd
SHA512

2d5561d1f152543b334c005ca9f83d0ca7e6d8441183e302bc54234d0cceea249e48b32cafc8c49423e84e9e99262ee23b5080f6a583451750fd7a971f257722
SSDEEP

6144:X7KW700i6NF5tkPdPot/YoUD0OKI8/0zIb:XyV6NDtYAF60OgR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ba0bc5906de4df130ef9c2b02fea8fd_JaffaCakes118

Files

1ba0bc5906de4df130ef9c2b02fea8fd_JaffaCakes118
.exe windows:5 windows x86 arch:x86

e84de30b2469d6453a9cb2ee4cb7e4ad

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetLastError
OpenProcess
GetCurrentThreadId
WaitForSingleObject
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
lstrcmpA
GetTempPathA
ExitProcess
lstrlenA
GlobalAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualQueryEx
GetModuleHandleA
GetThreadContext
CreateProcessA
GlobalFree
TerminateProcess
ResumeThread
VirtualFree
FindAtomA
VirtualAlloc
lstrcpyA

user32

CloseDesktop
GetWindowThreadProcessId
FindWindowA
GetCursorPos
GetThreadDesktop
OpenInputDesktop
wsprintfA
GetFocus
EqualRect
SetThreadDesktop
InflateRect
IsWindowVisible
ClientToScreen

shell32

ShellExecuteA

shlwapi

SHGetValueA

advapi32

CreateProcessAsUserA
OpenProcessToken

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE