6efe10374a8dc82b17779dc2ebe160f4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6efe10374a8dc82b17779dc2ebe160f4_JaffaCakes118
Size

67KB
MD5

6efe10374a8dc82b17779dc2ebe160f4
SHA1

4b38714d5734a34eef3738cc3ede7b3cd08921a0
SHA256

6ed755fe2884f58f00f43f8e4e8e901389a637775b1f1bcf9cc71ede574cca7a
SHA512

d37026b251f7f309a9e7b736106cad38e28b2264cfe9131b8cc4bcd0d5017c36e0a0a47c6e4b6de44d99a3a8fb772b935a7536df9095ab62865c50accd09d374
SSDEEP

1536:ZmVseOunh0X1IDWRUPSdwLeZcXr1IDWRUPSdwLeZcX9DFWfiu5Kyox+EGCoADT:ZmVzOJFWdg+fBI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6efe10374a8dc82b17779dc2ebe160f4_JaffaCakes118

Files

6efe10374a8dc82b17779dc2ebe160f4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a1c25d376c9c11dc5368fdaed9a98b5c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
LoadLibraryA
lstrcmpiA
VirtualProtect
GetProcAddress
IsBadReadPtr
CreateThread
GetModuleHandleA

user32

DefWindowProcA
SendMessageA
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA

Exports

Exports

func1
func2
start

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 691B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ