4d580da65c06e824bdbc00cc66e8c2bb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d580da65c06e824bdbc00cc66e8c2bb_JaffaCakes118
Size

16KB
MD5

4d580da65c06e824bdbc00cc66e8c2bb
SHA1

05bd5f6fc8f78702ec10ed7dddcf49d3e8c41a38
SHA256

f62b95fb43f5455de3d410147b4c16228d60ee8016cb772ffc4001ed4b9ffd11
SHA512

d8e08a0399e1ec04bd11809cfd45550434f2737aff7a80854578c6ea7b958abb57b9debe2bac1b7bb00f95a780b69fd090de6323ef56065131f4a6c0c322be14
SSDEEP

96:cScFoguES5ERmqn/m29f3FscOw28I88vtP4oynpEza/:fUcCZ3FscPLHCP4oynpJ/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d580da65c06e824bdbc00cc66e8c2bb_JaffaCakes118

Files

4d580da65c06e824bdbc00cc66e8c2bb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

40f1af548cb3672996a29ba9c3464762

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
CloseHandle
TerminateProcess
CreateProcessA
WaitForSingleObject
WinExec
GetModuleFileNameA
GetTempPathA

user32

EnumChildWindows
SendMessageTimeoutA
RegisterWindowMessageA
EnumWindows
GetWindowThreadProcessId
PostMessageA
GetClassNameA

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize
CoUninitialize

oleaut32

SysFreeString
VariantClear

shlwapi

SHGetValueA

msvcrt

_strlwr
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_stricmp
srand
time
wcslen
atoi
strchr
strstr
rand
__CxxFrameHandler
fclose
fwrite
fopen
sprintf

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 376B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE