4939f474dc205aad03041343b67b1269_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4939f474dc205aad03041343b67b1269_JaffaCakes118
Size

16KB
MD5

4939f474dc205aad03041343b67b1269
SHA1

aebffc21e7baa70685dfd962496bbe5508c04ac6
SHA256

0446165eb8e190986cd8df8819d993f447db514d848827ad1a13eb990d74c479
SHA512

84d35d26ac59ee6e66b5f38a6e3ff40589a00850fc4a7970840a200556b84a2cb4023a9d72ef793f30115e978bab62f76bf97a433588f8c529a0f5dd6fcb20b0
SSDEEP

96:J7n2lrLevEv5Ke+EJssytUAYuJAYT+ZiL+lrYvoIaR2u:J7C2vkYgtlGlT+Zq+RYv5k2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4939f474dc205aad03041343b67b1269_JaffaCakes118

Files

4939f474dc205aad03041343b67b1269_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7633d5cf714441400bde7afe88a0067c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

rand
_snprintf
_beginthread
exit
strncpy
??1type_info@@UAE@XZ
??3@YAXPAX@Z
_CxxThrowException
_endthread

kernel32

LocalFree
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
GetTempPathA
ExitProcess
WaitForSingleObject
CreateMutexA
SetErrorMode
MoveFileExA
CloseHandle
WriteFile
CreateFileA
SetFileAttributesA
GetModuleFileNameA
GetModuleHandleA

user32

BlockInput
MessageBoxA
OpenClipboard
SetClipboardData
SetForegroundWindow
SetFocus
ShowWindow
VkKeyScanA
keybd_event
CloseClipboard
EmptyClipboard

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
VariantClear
SysAllocString

shell32

ShellExecuteA

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE