64d9eed498f033021b94b906771ecfe8_JaffaCakes118 | Triage

Sharing

General

Target

64d9eed498f033021b94b906771ecfe8_JaffaCakes118
Size

8KB
MD5

64d9eed498f033021b94b906771ecfe8
SHA1

bc178ab65f84c8826d3298ee727624c58b5d01ff
SHA256

1b71d268d13ccaf540dbe41a8e49fcbf099db4a44ef7548525b7c699da34db20
SHA512

1e39378f8f6845a5a78ec0a81543b5a25eb7c1af052f7c5cccbb38d2298c57dd893b739be63797d5a0fb59ae42161e0aed825285e96638e158348d1d47bcc0a9
SSDEEP

96:ZXLhld7DcNB5dU3NsXBsBRm5b5jSQk9gLdAeylaGaeLNaVIUr:ZXNyQNk+A5zBAe7zeLUu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64d9eed498f033021b94b906771ecfe8_JaffaCakes118

Files

64d9eed498f033021b94b906771ecfe8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

40fd4e4d5dfc733f565b804379c74063

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateThread
CreateToolhelp32Snapshot
ExitProcess
GetCommandLineA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
Module32First
Module32Next
OpenProcess
ReadProcessMemory
RtlZeroMemory
WinExec
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpA
lstrlenA

user32

wsprintfA
CharUpperA
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
GetWindowTextA
GetWindowThreadProcessId
LoadCursorA
LoadIconA
PostQuitMessage
RegisterClassExA
SetTimer
TranslateMessage

wininet

InternetOpenUrlA
InternetOpenA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ