24eab4dc9243678386ff445473761936_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

24eab4dc9243678386ff445473761936_JaffaCakes118
Size

323KB
MD5

24eab4dc9243678386ff445473761936
SHA1

8b3b3b08f5e87d8fc09d0d285efa2da740762623
SHA256

5530fcc6052e02eb7e5e8ffc5ce7ee8ab6e66f65687a65d696ee062e8c3dd3e2
SHA512

5b8ffa6021ea5739165fbb18b65726c30e85413a43c57487de51afc45cf2d0de2c94a55546d0b94f4ad0ce8efdcf7796ebd3781e35294e4444673926ecf2a884
SSDEEP

6144:MgE+9zxIAXDOx12H6pNkbNRJWr6PKRUKcs2tXv+vu0:l9zzTOxy6HkB74cv85

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24eab4dc9243678386ff445473761936_JaffaCakes118

Files

24eab4dc9243678386ff445473761936_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6dd099f94038702fea19812bbce41f87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
GetProcAddress
GetModuleHandleA
LoadLibraryA
LockResource
VirtualFree
LoadLibraryExW
FreeLibrary
CreateFileA
GetTempFileNameA
GetTempPathA
WriteFile
CloseHandle
GetTickCount
LoadResource
SizeofResource
FindResourceA
ExitProcess
MoveFileExW
MoveFileA
GetCommandLineW

user32

DefWindowProcA
BeginPaint
EndPaint
PostMessageA
PostQuitMessage
SetTimer
RegisterClassExA
LoadStringA
DispatchMessageA
TranslateMessage
GetMessageA
ShowWindow
CreateWindowExA
UpdateWindow

shell32

CommandLineToArgvW
SHGetFolderPathA

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 68B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ