64b4c18db0fbdee14742689dd357638f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

64b4c18db0fbdee14742689dd357638f_JaffaCakes118
Size

420KB
MD5

64b4c18db0fbdee14742689dd357638f
SHA1

747c94b2a14e94e457c5f951b75e48e24f65a1ef
SHA256

f93396f106c538c9e6cb47ed3b8a4d290fc4366fe824bb4e6c113be3754ac51c
SHA512

c478d980ea5875054f74eb1fd18bae48d33457470f459bc0d4c584cae9898679d0af38d3be4f1f686d62a28b7695d2afa7c1b24feaf2fe149c5b599f415b19ae
SSDEEP

6144:iJlnLiSfOqz3uU7tYcFYL0NtSGPl26iya/iO5AmT8O2u7Oe03mijeX+3KwQi:iJhGO3X7tYcttSMllsH516+y1jeYKwt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64b4c18db0fbdee14742689dd357638f_JaffaCakes118

Files

64b4c18db0fbdee14742689dd357638f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ