5a638e6c8f11fd3b837d76bc5c2b19ce_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a638e6c8f11fd3b837d76bc5c2b19ce_JaffaCakes118
Size

444KB
MD5

5a638e6c8f11fd3b837d76bc5c2b19ce
SHA1

5c5c4fe6ba2bac7e4d81249fdf07cab099362989
SHA256

896632a0dabac72eeeb2412accd765c22e226d389d84cf9c4c20d3c537522b0f
SHA512

17b4765a431884ef5cca3eed4087347615643c4834880e6b86158bbf81ce5b2e75372e8f7c0b92a11a02d81883d7c4662f7c4135f1e648aa0766a32add9f114c
SSDEEP

12288:D8r+finYzrX9ipDnpzYewFFMsrvBrEdAzkno:aZCrEBpzYHFFvr5o2zkno

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a638e6c8f11fd3b837d76bc5c2b19ce_JaffaCakes118

Files

5a638e6c8f11fd3b837d76bc5c2b19ce_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5f2df7257758bf2707e2911007001ebd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResetEvent
CreateThread
LoadLibraryA
FindResourceA
GetModuleHandleA
LocalAlloc
LocalFree
GetCommandLineW
GlobalAlloc
GlobalFree
SetEvent
CreateProcessA
ExitProcess
GetTickCount

user32

GetClientRect
GetWindowRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
ShowWindow
UpdateWindow
CreateWindowExA
LoadBitmapA
SendMessageA
DestroyWindow

Sections

.text
Size: 31KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.KJj-sDs
Size: 355KB - Virtual size: 628KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.KJj-sDs
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ