5e8f48c736e0e930f52abd89d49c6b27_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5e8f48c736e0e930f52abd89d49c6b27_JaffaCakes118
Size

380KB
MD5

5e8f48c736e0e930f52abd89d49c6b27
SHA1

c550bb27d57d7b315b6f627239d2c2450fb8d098
SHA256

d7cb0e7850ee64ad9d65d0507191b39d051e737598be5acc701d04536b79bc50
SHA512

fd791c8d28bf5701ca9aa1492a9d48f427bc066aff4acc326a6473756b07e2cdaf1c551734f79d624085866e646d0b88486dd6691595fb4c3858d11f6b6edbdc
SSDEEP

6144:e4A8uBC08Nmxbr35gwnez9n2nXjKz0SxCKEe373SZsYqLYv7I5jPEQ9+DkKYnjIH:BAXr8+/3m6ez9n2XjSxCF673JYq0v7ma

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e8f48c736e0e930f52abd89d49c6b27_JaffaCakes118

Files

5e8f48c736e0e930f52abd89d49c6b27_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fd2768f102fa1d8d89c05cf508c04bc9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
GetProcAddress
VirtualAlloc
GetModuleHandleA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
HeapReAlloc
LoadLibraryA
GetStringTypeW

user32

GetActiveWindow
ShowWindow
SendInput

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ