6577994af8993e125eec888019ff1770_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6577994af8993e125eec888019ff1770_JaffaCakes118
Size

420KB
MD5

6577994af8993e125eec888019ff1770
SHA1

520d32d70979101c71de4c2debd78a65e5559ea8
SHA256

8ef60b4711abf72cab1f00eb4828a66f2c05ce8b8892c9c630ebbd7b429eec29
SHA512

8b28acac11897e727d74504be5e4559a6bb9797c14db2c566a3608a7a39e34d5d60efa7d52ade74124dc2f38ff59e824984483780249e2e36dff304119ed5f9e
SSDEEP

6144:iJlnLiSfOqz3uU7tYcFYL0NtSGPl26iya/iO5AmT8O2u7Oe03mijeX+3KwQa:iJhGO3X7tYcttSMllsH516+y1jeYKwN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6577994af8993e125eec888019ff1770_JaffaCakes118

Files

6577994af8993e125eec888019ff1770_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ