5e64175ad7bbda5ea38fc772d0918a92_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e64175ad7bbda5ea38fc772d0918a92_JaffaCakes118
Size

120KB
MD5

5e64175ad7bbda5ea38fc772d0918a92
SHA1

bd6f86662317c424c7393597baa63089d8f301e4
SHA256

a72153c7b61b4dae64544b8500322d1701f8c54fbef0b0b172c9b2df0b4623ba
SHA512

879b90351c009a4f1dc4d59fb4312a2cd08347af846684a1df3c1058cbead69f28677fcaa699bffce5ca51638a966b78c113f4fff85a7ed97d67937d461cf610
SSDEEP

1536:tNYQVnF9YxFmt9sZT0U5oBCZTwvtVpL/v5cglT61I2GuhBoxA+S4H5YuKl8YvXWF:XQU8T0U5822V5/hZlTqxBovCnvXWJGu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e64175ad7bbda5ea38fc772d0918a92_JaffaCakes118

Files

5e64175ad7bbda5ea38fc772d0918a92_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2b6dd5944f17c4d2d93ecb3d6c28c94c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
GetComputerNameA
GetStdHandle
GetCurrentProcessId
VirtualAlloc
GetVersionExA
LocalFree
GetCurrentDirectoryA
ExitProcess
SleepEx
GetCurrentThread
CreateEventA
GetWindowsDirectoryA
GetCurrentThreadId
LocalAlloc
GetSystemDirectoryA
GetCurrentProcess

advapi32

GetUserNameA

user32

GetActiveWindow
GetForegroundWindow
GetSystemMetrics

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ