338d3120c68fd45a6439456e7e27d24b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

338d3120c68fd45a6439456e7e27d24b_JaffaCakes118
Size

5KB
MD5

338d3120c68fd45a6439456e7e27d24b
SHA1

c0d084302ffd4371546b326c863cf1969afb4f14
SHA256

9b46d46ba424d3f9458be45420824199cb1de8a80669861859f7df00c6f3488e
SHA512

c149cca1c863ca6d21525b22328dcb5a98ab010e4b1b9c1b53420b802069c7e059b13ec08b12db583c107f252d833aeb70fb67dbd1f4f45243e0f4c93fb38268
SSDEEP

96:h59S+nZ5wT+HFoACxOljQLj1s43hKu55d4cuCoSJagRBX:NpwTOoACshOj4JCtbRB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
338d3120c68fd45a6439456e7e27d24b_JaffaCakes118

Files

338d3120c68fd45a6439456e7e27d24b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a2077234599774c36f5f70900d7d011a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA
MessageBoxA

kernel32

CreateProcessA
WaitForSingleObject
CloseHandle
OpenProcess
GetModuleHandleA
VirtualFreeEx
RtlMoveMemory
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetProcessHeap
ExitProcess
HeapAlloc
GetModuleFileNameA
HeapFree
IsBadReadPtr
GetStartupInfoA

urlmon

URLDownloadToFileA

msvcrt

modf
_ftol
sprintf

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE