20c9d400119d3e05e3034e4f1c5c8185_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20c9d400119d3e05e3034e4f1c5c8185_JaffaCakes118
Size

132KB
MD5

20c9d400119d3e05e3034e4f1c5c8185
SHA1

7891864033334401eb2e5a02f16133e7415af52a
SHA256

aa55da81ddd4b8ab7d6ac28660671f57faf0ff58a11e3a046452c92aa9cb38bf
SHA512

fd529444313d6a77afb16db458898719181c53584340cbc59cdcb00f1db6585df9c0b6d883ca8f113e4d4cd4867040fad7d9d6d95be7e6a6fe403d2c8c1f9b92
SSDEEP

3072:4QzoUD1kloqrofPVTTyCZ2vSw2xn/0NouK+GgnkqzozE:44oUR4oqMdyreN+hkqL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c9d400119d3e05e3034e4f1c5c8185_JaffaCakes118

Files

20c9d400119d3e05e3034e4f1c5c8185_JaffaCakes118
.exe windows:5 windows x86 arch:x86

96a41fa67a13dc266ccad3eec88296c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadWritePtr
WriteConsoleInputA
SystemTimeToTzSpecificLocalTime
GetCurrentThreadId
GetLongPathNameW
GetCommandLineA
ReadConsoleOutputAttribute
Module32First
GetProcessWorkingSetSize
VirtualAllocEx
SetCommConfig
GetDiskFreeSpaceA
GetComputerNameA
HeapAlloc
lstrcpyA

user32

InsertMenuItemA
MapVirtualKeyExA
GetWindow
ShowCursor
UnregisterUserApiHook
SetProgmanWindow
GetLastActivePopup
SetCursor
GetRawInputDeviceInfoA
SetScrollPos
CreateWindowExA
AllowSetForegroundWindow
SetWindowPos
RegisterHotKey
BroadcastSystemMessageA
CreateIconFromResourceEx
PostQuitMessage
EnumChildWindows
GetMenuItemRect
TranslateMessage

gdi32

SetAbortProc

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ