5e24d7fd21e553e692b2587cf4f5b379_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e24d7fd21e553e692b2587cf4f5b379_JaffaCakes118
Size

7KB
MD5

5e24d7fd21e553e692b2587cf4f5b379
SHA1

5bea02697f53164cba11e1a9925c813137e6da64
SHA256

3415d867aac73261fcb708f34c0094fd57719faa64466134a38132970a267199
SHA512

9565c394e6c4f4b4d876ee831da5f9923736c133701262ef0fa7a86c9df49e8b251ef3fa92473150573400d227a84fc18878b16696cb060b0e9504135722da09
SSDEEP

192:6r8kuGMhQQyGlvKSWBptkq+eNI/+/v8e:TG0yAKjI/+vJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e24d7fd21e553e692b2587cf4f5b379_JaffaCakes118

Files

5e24d7fd21e553e692b2587cf4f5b379_JaffaCakes118
.exe windows:4 windows x86 arch:x86

be8fb5bb3009299ec8612626f41b4d43

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
WideCharToMultiByte
lstrcpyA
lstrcatA
CreateEventA
HeapAlloc
HeapFree
GetProcessHeap
ReadFile
WaitForSingleObject
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
InterlockedExchange
VirtualQuery
ResetEvent
ExitProcess
CloseHandle

user32

PeekMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
DestroyWindow
ShowWindow
GetParent
AnyPopup
MsgWaitForMultipleObjects

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE