638555903eda1324d0c87d92baab9125_JaffaCakes118 | Triage

Sharing

General

Target

638555903eda1324d0c87d92baab9125_JaffaCakes118
Size

420KB
MD5

638555903eda1324d0c87d92baab9125
SHA1

9f4d837fe1ad31c266e5e7809553c7efb3f856ce
SHA256

44b7657eb19a34c634eebc1ce011d775605c92508461cae550a92781d6e8841e
SHA512

55091ee093a16f53327b042014394b5ee6ed567b3ef9c50194db70182c4a0d304b610c14260a92517dbb328cb858087a789e4196b466c2f17ae6c4696b8f7704
SSDEEP

6144:iJlnLiSfOqz3uU7tYcFYL0NtSGPl26iya/iO5AmT8O2u7Oe03mijeX+3KwQa:iJhGO3X7tYcttSMllsH516+y1jeYKw9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
638555903eda1324d0c87d92baab9125_JaffaCakes118

Files

638555903eda1324d0c87d92baab9125_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ