34fb61f28d25c7f61243a065888f766e_JaffaCakes118 | Triage

Sharing

General

Target

34fb61f28d25c7f61243a065888f766e_JaffaCakes118
Size

67KB
MD5

34fb61f28d25c7f61243a065888f766e
SHA1

3005d8f6cb00f2fce589658fe25899cf79839def
SHA256

1f44760a1a6e0fce55548f52c3209189c4006dc4e338f26f7df943e060d872b6
SHA512

6af8e9f5dbb4040e87da99c84181f2a10d289bf91eb6fd2c2dc9ecb72ed1be7036c5ab5cfbd455da11f6fc3893de017df7f7e4a8ea780768186969e76708e678
SSDEEP

1536:yX8yYxnPuxTa+HfQqKZVtdRdVTenT0G0avIFBYhLGa4Cdbfgkc:yX2uxTjQ3/tdxcT0G0DE5Ga4eboz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34fb61f28d25c7f61243a065888f766e_JaffaCakes118

Files

34fb61f28d25c7f61243a065888f766e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1a652750323ecd5b4918a73aefedba18

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
CreateEventA
SuspendThread
GetProcAddress
LoadLibraryA
VirtualFree
VirtualProtect
VirtualAlloc
LockResource
GetWindowsDirectoryA
LoadResource
FindResourceA
HeapFree
GetProcessHeap
VirtualProtectEx
VirtualAllocEx
GetCurrentProcess
CreateFileA
ExitProcess
GetFileSize
GetModuleHandleA
GetStdHandle
LocalFree
ExitThread
HeapAlloc
InterlockedExchange
RtlUnwind
VirtualQuery

user32

GetSystemMetrics
RegisterClassA
GetForegroundWindow
PostMessageA
CreateDialogParamA
FindWindowA

ole32

CoCreateInstance

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ