2f888bfd1f345084eeab7213569b8198_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f888bfd1f345084eeab7213569b8198_JaffaCakes118
Size

434KB
MD5

2f888bfd1f345084eeab7213569b8198
SHA1

e9c685522227b7aaa703be8e1fc1756f3385cd74
SHA256

adffc71428384fda1509290144ba2e8c491687c771f0b80d6493a38c1c208f9c
SHA512

2882a3101262f311587da699a98a912577ce2e3038d26b714ca146c416b0a9dd550491327a03e799359d28d20588be8758e402de74592082724710a2f7b54670
SSDEEP

3072:Mjp5iZnDEjH5mWRAzmbM0rb5XVRbpX+WR:MjPEnDEjH5mgAzx8bDppv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f888bfd1f345084eeab7213569b8198_JaffaCakes118

Files

2f888bfd1f345084eeab7213569b8198_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6f612ff9df75a349bf75e1e790da9199

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
ExitProcess
GetWindowsDirectoryA
lstrcatA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
FindResourceA
LoadResource
LockResource
SizeofResource
CreateFileA
WriteFile
CloseHandle
OpenProcess
VirtualAllocEx
WriteProcessMemory
LoadLibraryA
GetProcAddress
CreateRemoteThread
WaitForSingleObject
CreateThread
SetThreadPriority
HeapAlloc
HeapCreate
HeapDestroy
Sleep
ReadFile
SetFilePointer

user32

DialogBoxParamA
SetTimer
LoadBitmapA
SendDlgItemMessageA
FindWindowA
EndDialog
GetWindowThreadProcessId
GetDlgItem
SendMessageA
RegisterHotKey
ReleaseCapture

gdi32

CreateFontA
SetBkMode
SetTextColor
SetBkColor
CreateSolidBrush
GetStockObject

winmm

waveOutClose
waveOutGetPosition
waveOutOpen
waveOutPrepareHeader
waveOutReset
waveOutUnprepareHeader
waveOutWrite

Sections

code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

data
Size: 9KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ