4ceb360c9890b5e4292211624d0857cd_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4ceb360c9890b5e4292211624d0857cd_JaffaCakes118
Size

2.7MB
MD5

4ceb360c9890b5e4292211624d0857cd
SHA1

eab57815b2046a04e21a21ff2fd00782d214ee1b
SHA256

29da8a2c4876a0767f27fc5197704648c3a19058bc05895760d094ed41925c50
SHA512

377d559f4144a304de3cb8b411e904028ecbb76b558def482aa45b2801c85a2c6941116bc875e5abd00e92ac079c94c943136e3fa82ef30d55855e81bdc5c314
SSDEEP

49152:4CzC/E1X9jBHo+JsFgAAatZ5kTopr09B2gHlc4X+C2mmkc8yuRTOmnk:4bs1NjBHo+J8RAaYIA9tc4jmkc8rdOx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ceb360c9890b5e4292211624d0857cd_JaffaCakes118

Files

4ceb360c9890b5e4292211624d0857cd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5f2df7257758bf2707e2911007001ebd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
CreateThread
LoadLibraryA
FindResourceA
GetModuleHandleA
LocalAlloc
LocalFree
GetCommandLineW
GlobalAlloc
GlobalFree
SetEvent
CreateProcessA
ExitProcess
GetTickCount

user32

GetClientRect
GetWindowRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ShowWindow
UpdateWindow
CreateWindowExA
LoadBitmapA
SendMessageA
DestroyWindow

Sections

.text
Size: 2.0MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dyamarC
Size: 375KB - Virtual size: 648KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dyamarD
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 232KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ