5b840bf161b79ab38f54deb9dfc970da_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5b840bf161b79ab38f54deb9dfc970da_JaffaCakes118
Size

35KB
MD5

5b840bf161b79ab38f54deb9dfc970da
SHA1

d698429fa1026b31bde0eb987192fdb21576a28e
SHA256

1620d2900487cef5acaf73131d7d336f381c3f6cca1670179d1d8ec2b917fe5d
SHA512

a695c91bd5d8aae1d0b3ae6944cb0fca793792f554641b1bee6ab1ae614a022d3a66e17800691bbc8d1133b608efd23dfb005ef0d7daf175578f5d7517bd6db3
SSDEEP

768:EwPJePOtHbc+W+PSnonSaxcCDQbRDm8WIgBfy3D:EaJePOtHoEaonSaxcCDKRCxFZy3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b840bf161b79ab38f54deb9dfc970da_JaffaCakes118

Files

5b840bf161b79ab38f54deb9dfc970da_JaffaCakes118
.dll windows:4 windows x86 arch:x86

514c4c1141c3d9d3dcedb42bddd01132

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FlushFileBuffers
GetCommandLineA
GetModuleHandleA
InitializeCriticalSection
ExitThread
SetEndOfFile
Sleep
SleepEx
lstrcpynA
MapViewOfFile
ExitProcess

user32

OemToCharA
CharToOemBuffA
MessageBoxA
DeleteMenu

advapi32

RegOpenKeyExA

Sections

.text
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 10KB - Virtual size: 56KB

IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ