266b2bc03fa450885bf19b29c3e97ab4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

266b2bc03fa450885bf19b29c3e97ab4_JaffaCakes118
Size

233KB
MD5

266b2bc03fa450885bf19b29c3e97ab4
SHA1

79d2d897f5b8e1a20ce5b7bfc5f0a42ed7e5b088
SHA256

6a2daaac2bdd5549b7584461113ebaaa19e96f02918e43999544cc80feb87103
SHA512

f5e79f2caebcc767787ff55977a7fc926b692acc0f7ba01427d0eb78d6b5910463a1ad97234580175889d134f7e56335e5417987d753918c4d3e60ac8f4c0258
SSDEEP

3072:+r9HwUmY/aPAtSgrctRPXp8EqWy9DCCQ53IEsHU1ObJ5VTS2pmTVlBNY:+r9Hw3PBUS7BECF1mUBN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
266b2bc03fa450885bf19b29c3e97ab4_JaffaCakes118

Files

266b2bc03fa450885bf19b29c3e97ab4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cc706ab1d86d2476d4001b5c04e1ae33

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessWorkingSetSize
WriteConsoleInputA
LocalHandle
IsValidCodePage
FindResourceA
GetProcAddress
WriteConsoleOutputAttribute

user32

GetMessageTime
DdeGetData
SetWindowPos
UnregisterClassW
GetForegroundWindow
CheckRadioButton
ReleaseCapture
GetWindowRgn
CallWindowProcA
GetMenuCheckMarkDimensions

gdi32

CancelDC
SetPolyFillMode
CopyMetaFileA
ModifyWorldTransform

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE