6446604d5e24aa820f4bf775542210ee_JaffaCakes118 | Triage

Sharing

General

Target

6446604d5e24aa820f4bf775542210ee_JaffaCakes118
Size

6KB
MD5

6446604d5e24aa820f4bf775542210ee
SHA1

af0976dd10dc2a8b246be63ae659e65ec5591a54
SHA256

b055290929e03b0baa112a6e0e55a54738d8922b823cadc8c693e0baf4418df8
SHA512

c2dae1d812969320fff29dfbcd5d72a79539d02ebb4884065ade425e67a67582dbad84a7b0b3a9e02ea2ae59a81b6a15cf792b83b8d061adfea919049d059577
SSDEEP

96:UZfLSRb72Rq4ZShwCQeBGSwb9tAkWFdVlnMdXwtRL7+3evAnPLR:JhqA4ZODwb/AkWFdVlnzDP+3XnPl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6446604d5e24aa820f4bf775542210ee_JaffaCakes118

Files

6446604d5e24aa820f4bf775542210ee_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ac5c7e3cc6097b1c93b87c97a04556b0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32First
CreateToolhelp32Snapshot
Module32Next
Module32First
GlobalFree
VirtualFreeEx
WriteProcessMemory
VirtualProtectEx
Process32Next
TerminateProcess
GetModuleHandleA
GetStartupInfoA
ExitProcess
GetCommandLineA
IsDebuggerPresent
VirtualProtect
OpenProcess
GetCurrentProcess
GlobalAlloc
CloseHandle

user32

MessageBoxA
EnumWindows
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItem
DialogBoxParamA
SendMessageA
EndDialog
CharUpperA
GetWindowThreadProcessId

advapi32

LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ