3d611256dce6d1b0575a069b86e42892_JaffaCakes118 | Triage

Sharing

General

Target

3d611256dce6d1b0575a069b86e42892_JaffaCakes118
Size

8KB
MD5

3d611256dce6d1b0575a069b86e42892
SHA1

f985bfabc8414ef5ce6a853e94814d5970a909e8
SHA256

3f792bd99d024ec47d84399342d087eb5d41de177cb4aef2168b526d5e9f3694
SHA512

a2b8eed6449ad69c57a0dc02c7df89f273525a39506b3556b9c7ba2b6a41229e780ec407452364af6ddc3e6a84b5fe6722b164e0aa7a770dd6dd4e945d20af14
SSDEEP

192:WGyXRdMGP9U34N6zJ4EU3dHcOcZa26xJ8p:RyXRdb1UQIS5P26X8p

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d611256dce6d1b0575a069b86e42892_JaffaCakes118

Files

3d611256dce6d1b0575a069b86e42892_JaffaCakes118
.exe windows:1 windows x86 arch:x86

251575623650bc933bad8739ca1c1602

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
Sleep
CreateThread
ExitProcess
VirtualAlloc
RtlMoveMemory
WaitForSingleObject

user32

MessageBoxA

ntdll

NtSetInformationThread
RtlDecompressBuffer

Sections

.
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 390B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.
Size: 1024B - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ