4ad03e4bd65a44f8b80f55a94219bf99_JaffaCakes118 | Triage

Sharing

General

Target

4ad03e4bd65a44f8b80f55a94219bf99_JaffaCakes118
Size

200KB
MD5

4ad03e4bd65a44f8b80f55a94219bf99
SHA1

6357a0db6293b3d0e08958e9c651337e41b4c273
SHA256

517b26aabddfa16d4797438bd8be40a5335bfae61173c93a2a552642f5ecb035
SHA512

b78d750844de1091821f99f87d89511aafdcedb7aea7640c9eaa48b68537a0512f6ec268a8cd84bcb3e63bc295be8bf7ff2868d985d7ea7ab32f82ab486f50cd
SSDEEP

6144:CTDefxGZ6wW7MuFL3nn7x+wclk9YBh2yeK:CTDef0W7MOL37xskaKK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ad03e4bd65a44f8b80f55a94219bf99_JaffaCakes118

Files

4ad03e4bd65a44f8b80f55a94219bf99_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1bd38099ef213c0375b6a6670f1e4571

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
FindAtomA
OpenProcess
GetCurrentThreadId
WaitForSingleObject
CreateProcessA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
lstrcmpA
GetTempPathA
lstrlenA
VirtualAlloc
GlobalAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualQueryEx
GetModuleHandleA
GetThreadContext
GlobalFree
TerminateProcess
ResumeThread
VirtualFree
lstrcpyA
ExitProcess
lstrcatA

user32

InflateRect
GetCursorPos
CloseDesktop
GetWindowThreadProcessId
IsWindowVisible
SetThreadDesktop
GetThreadDesktop
OpenInputDesktop
GetFocus
FindWindowA
wsprintfA
EqualRect
ClientToScreen

shlwapi

SHGetValueA

advapi32

CreateProcessAsUserA
OpenProcessToken

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE