4d530d6842fb0e9b0c301445c2797491_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d530d6842fb0e9b0c301445c2797491_JaffaCakes118
Size

131KB
MD5

4d530d6842fb0e9b0c301445c2797491
SHA1

bdfb944efeadad7528aa22066cfb2fd5bef8d41d
SHA256

b692dcc792f3648eca7ef55965a832dcf82b627eb04a4cc25ce45e8a8e63f63e
SHA512

1fdc42aa670dfb55f644bb154bcc6e51c00a461e289f0f694380437ee73c0992ea92be350bb391bc05fcf864ccae7a7b1550c6c92feeb0705bb1f26f4ea2a256
SSDEEP

3072:/e+Ylag8h/WcJGmeGkJwBOYZrOCFv9OmaWwBNPtoi+uhocl:7Y98h+bmeTJnY1OCFvptKNlMup

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d530d6842fb0e9b0c301445c2797491_JaffaCakes118

Files

4d530d6842fb0e9b0c301445c2797491_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0de5d89987cf34e83f35640f7f52b627

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
strncpy
strcmp
memmove
memcpy
_CIacos
_CIsinh
_CIlog
strlen

kernel32

GetModuleHandleA
HeapCreate
Sleep
HeapDestroy
ExitProcess
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapReAlloc
HeapAlloc
HeapFree

user32

CallWindowProcA
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
GetWindowLongA
SetWindowPos
EnableWindow
EnumWindows

comctl32

InitCommonControlsEx

ole32

CoInitialize

Sections

.code
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 105KB - Virtual size: 108KB