4dde6defb9d428a0cd87ca6ae9a14b83_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4dde6defb9d428a0cd87ca6ae9a14b83_JaffaCakes118
Size

5KB
MD5

4dde6defb9d428a0cd87ca6ae9a14b83
SHA1

7d085db9d13ea41536f87f6c745c7096f6db21ba
SHA256

65b5b51939722ccc1f380a16c28661734df3b37c916142c8153642594437ccf1
SHA512

bd2e942c3252e6cf68de7a9e1beab40860348de721cc8554e06fe880af6d501db2e3dc3b66af8bcc5d627fed181f2f6093b9cc5c7057c004e198dfa22932e007
SSDEEP

48:CBAXOK54xdIFA56JyeypyO2fkstuTJW9xGZHdpPFKT1WiIZbq6goqH3IPABrHv2e:hXhMYA5uyeypyO2FMF+M363I49HOG/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dde6defb9d428a0cd87ca6ae9a14b83_JaffaCakes118

Files

4dde6defb9d428a0cd87ca6ae9a14b83_JaffaCakes118
.exe windows:4 windows x86 arch:x86

15ba5fb3c652548f2f04e63c52cc6fd2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
WideCharToMultiByte
GetModuleFileNameW
lstrcatA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateProcessA
WaitForSingleObject
CloseHandle
WaitForMultipleObjects
HeapAlloc
GetProcessHeap
HeapFree
Sleep
ExitProcess
GetModuleHandleA
GetCommandLineA
CreateEventA
SetEvent
CreateThread
ExitThread

user32

SetParent
ShowOwnedPopups
PeekMessageA
DestroyWindow
CloseWindow
MsgWaitForMultipleObjects
TranslateMessage
DispatchMessageA
CreateWindowExA
CharUpperA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE