41ed20c4a65c48bebf29735c1f195153_JaffaCakes118 | Triage

Sharing

General

Target

41ed20c4a65c48bebf29735c1f195153_JaffaCakes118
Size

7KB
MD5

41ed20c4a65c48bebf29735c1f195153
SHA1

c5d840d9de2c0deb5defb2ab8f7061a1d7ae0e90
SHA256

b80cee42a982794434e9f45574f4fdcd1ff09a3a631a1f8f54fb731d01a344b8
SHA512

9f85cd87a74de60a6460e5c4f125009fed8ea7d6331f775a557c1b80b82c3e2ccf4bdb4eb5e35ac28766ce96af342280b4dfc71aca1507994ffafdbcb42169e6
SSDEEP

192:Re5MzOud1kqMyGwovKSGf+ul0jLyEMIOs+/v8i:RrzHbMySKi3LeIOs+v9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41ed20c4a65c48bebf29735c1f195153_JaffaCakes118

Files

41ed20c4a65c48bebf29735c1f195153_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa2667d7158b6b57b4af6fd77e4876b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
lstrcpyA
WideCharToMultiByte
CreateEventA
VirtualQuery
InterlockedExchange
WaitForSingleObject
CloseHandle
ResetEvent
GetModuleFileNameW
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
GetFileAttributesA

user32

GetDesktopWindow
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE