67b06cb9387790ce2051207c251550b2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

67b06cb9387790ce2051207c251550b2_JaffaCakes118
Size

134KB
MD5

67b06cb9387790ce2051207c251550b2
SHA1

8076a21c75c518eed7c8baff0891d9cf2d83a5b6
SHA256

52fcbb60af7de3367bc61b29f52f11a1808ace0ac458e40420ae68292d58bb71
SHA512

9f9b4c352a200d067a1afc1116e99f53adaa652702c791d43ce097316fa22b371fa89a96b0ab5f442ae964032e72a52f63feea7091ded256bbea7cfdac21ef11
SSDEEP

1536:BHHIYpEAyW0CzBiBXJMiOTygeoasc4F/EXCRHdGvv8TRJ6m+drB:RdpPliPMi9FtrCRiv2J6m+f

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67b06cb9387790ce2051207c251550b2_JaffaCakes118

Files

67b06cb9387790ce2051207c251550b2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

71411def9c77f166cb46b28a8e8b33c4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

InitCommonControls
CreateStatusWindowA

user32

SetTimer
SendMessageA
RegisterClassExA
PostQuitMessage
MessageBoxA
LoadIconA
TranslateMessage
KillTimer
GetMessageA
GetCursorPos
DispatchMessageA
DefWindowProcA
CreateWindowExA
LoadCursorA

kernel32

lstrcatA
WriteProcessMemory
VirtualAllocEx
Sleep
SizeofResource
SetThreadContext
RtlZeroMemory
ResumeThread
LockResource
LoadResource
CreateProcessA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetThreadContext

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE