6940b2da49a92dc5f0310e9c31676c51_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6940b2da49a92dc5f0310e9c31676c51_JaffaCakes118
Size

420KB
MD5

6940b2da49a92dc5f0310e9c31676c51
SHA1

7d643973a2173468c7e0e1b845eae1400926aaad
SHA256

5eb6625eea987a05956c95327406b2e05cc9b92767d7878a616059f15b3288c3
SHA512

9817ec8abee1d08685ea4a2994f612a76ce350976ef88889af86f2a3365db2fc8c9b068b0c7d6163f1a2b37a437dbc684d2f71f5a70619bb1acfead1b2b846b4
SSDEEP

6144:iJlnLiSfOqz3uU7tYcFYL0NtSGPl26iya/iO5AmT8O2u7Oe03mijeX+3KwQY:iJhGO3X7tYcttSMllsH516+y1jeYKwX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6940b2da49a92dc5f0310e9c31676c51_JaffaCakes118

Files

6940b2da49a92dc5f0310e9c31676c51_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ