28f0ec43b48255e114c1cacb46151366_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

28f0ec43b48255e114c1cacb46151366_JaffaCakes118
Size

239KB
MD5

28f0ec43b48255e114c1cacb46151366
SHA1

3fd1b4820d229ac7af0c4fcbbdf9dc1c9c25a1f2
SHA256

f461a1bdd4a29c47ee8c8d9fa716bc499d6fdd965dec66214957827c92524781
SHA512

797bf886132933c51510e6fc6ac65279128a746e0f07322a3c6772f93613fcae976b6e4dfe7829cafc01c4135300e94aaf48b24fdfae82e9e0e4f94ad3200bd3
SSDEEP

6144:f2ceWnCCddHcmm05vvhdOwyrLCtGnl8C:+ceWF/XWw6UGD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28f0ec43b48255e114c1cacb46151366_JaffaCakes118

Files

28f0ec43b48255e114c1cacb46151366_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ef4729a66c398f2cc1415670d297ce64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
DeleteFileA
GetWindowsDirectoryA
GetCurrentProcess
SetFileTime
GetFileTime
ExitProcess
LoadLibraryA
GetModuleFileNameA
Sleep
LockResource
LoadResource
SizeofResource
WriteFile
WaitForSingleObject
SetThreadPriority
CreateThread
GetCurrentThreadId
TerminateProcess
OpenProcess
CreateEventA
OpenEventA
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
CloseHandle
GetModuleHandleA
FindResourceA

user32

GetWindow
FindWindowA
SendMessageA
GetWindowTextA
GetClassNameA
PostMessageA
MapVirtualKeyA
GetThreadDesktop
wsprintfA
EnumThreadWindows

advapi32

RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ