5f1488a7c66f4172f548fcadeaa40560_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5f1488a7c66f4172f548fcadeaa40560_JaffaCakes118
Size

9KB
MD5

5f1488a7c66f4172f548fcadeaa40560
SHA1

44ae159d8a6201f2b0c9d2c5e90ded221e503810
SHA256

744bb90c88b7fd847796af047a4689cff089b59fa4bb09bbb2d9d4ccabfc1c8b
SHA512

1ff4c267b02dda714caa4faf07fa1ba59af6d5e115ce23d758d8883a91f19a88402efcad087bd81b64662a3d0df0354ec334bfbd1d427fe8a15efc702fc52c4e
SSDEEP

192:UpGEjB4odq5SkY/1NHnpiSlzJRtAQMFnklJ2mptUI5t:UpGEV4REkY/ASxJRtMivTUI5t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5f1488a7c66f4172f548fcadeaa40560_JaffaCakes118

Files

5f1488a7c66f4172f548fcadeaa40560_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d86a40f6aa2cd4f6127a0380228663de

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
HeapFree
GetProcessHeap
CreateThread
GetLogicalDriveStringsA
SetErrorMode
GetNativeSystemInfo
lstrcpyA
GetVersionExA
GetCurrentProcessId
GetModuleFileNameA
MoveFileA
HeapAlloc
HeapReAlloc
GetFileSize
GetLastError
CreateMutexA
DeleteFileA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
VirtualProtect
LoadLibraryA
lstrlenA
CloseHandle
ExitProcess
Sleep

user32

GetWindowTextA
IsWindowVisible
EnumWindows
MessageBoxA
SetWindowTextA
ShowWindow
SendMessageA
wsprintfA

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE