5a86389c465d874270516a0e3570fa24_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5a86389c465d874270516a0e3570fa24_JaffaCakes118
Size

9KB
MD5

5a86389c465d874270516a0e3570fa24
SHA1

89caa240376d6997a4878a99669a3f5ad537dd35
SHA256

1c3ad632388aa0cd4acabdb7dd080d7bfa5bae25c69264bd59c43457657bbe52
SHA512

d398ff1760fc4fcc760a5e7ae81a87364d05021c53e9f873a5f0c2233615e7b422768c975d3b12da299a4133102642c731a93e9d68111db0fcd53e98eb5e2ad6
SSDEEP

192:ZgVOYZnQb2Phlk3IholXX0vfiqfm2snvZ6Zn3Smg:knQbe5hskiGdQZ6J3Smg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a86389c465d874270516a0e3570fa24_JaffaCakes118

Files

5a86389c465d874270516a0e3570fa24_JaffaCakes118
.exe windows:1 windows x86 arch:x86

f9aaf911277114b016964be4f6af41f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
LeaveCriticalSection
LoadLibraryA
UnhandledExceptionFilter
lstrcmpiW
lstrlenA

user32

BeginPaint
DefWindowProcW
DispatchMessageW
SendDlgItemMessageW

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ