36c63316c8c447d5cb25191a808b05b9_JaffaCakes118 | Triage

Sharing

General

Target

36c63316c8c447d5cb25191a808b05b9_JaffaCakes118
Size

166KB
MD5

36c63316c8c447d5cb25191a808b05b9
SHA1

bac7b159de57c37ee32dc575f51aa405af3c5589
SHA256

9c292ce0fc407dee73023181004347251a8146135ef87762541f7889cb5e2a94
SHA512

31355db0a708cd23d3e6fb0aac5c8cfb29eeeda85acf2e75e79edd26133b8d160a6b30be7e4e877e25273dd523d2276491615e92f248224c1ea1dfd685b79d06
SSDEEP

3072:dGb6iRWp6lM5bfSwJFtVkOgdUOTzYCoiijuef25Q3Sw3J2O3bMolJC:dGbdRW4+5bHuOgUOTzY9525QCu3b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36c63316c8c447d5cb25191a808b05b9_JaffaCakes118

Files

36c63316c8c447d5cb25191a808b05b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d81a5533d99e25af8177b6d2646ad74

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
_isnan
sprintf
strncpy
strcmp
memmove
memcpy
_CIpow
strlen

kernel32

GetModuleHandleA
HeapCreate
Sleep
HeapDestroy
ExitProcess
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapReAlloc
HeapAlloc
HeapFree

user32

CallWindowProcA
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
GetWindowLongA
SetWindowPos
EnableWindow
EnumWindows

comctl32

InitCommonControlsEx

ole32

CoInitialize

Sections

.code
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 57B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data0
Size: 139KB - Virtual size: 140KB