712774cef7f33a2c8def72ecf27d2ce9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

712774cef7f33a2c8def72ecf27d2ce9_JaffaCakes118
Size

200KB
MD5

712774cef7f33a2c8def72ecf27d2ce9
SHA1

9cb2c517b0d2b5031e5d2ed3d3d149254c821ca5
SHA256

f5f99021591e88b71c2f2358185f06d0e086a28b19fde0d21e2d9a5e36241202
SHA512

4a5e900ff8060753a02e7a7dc2a2d459d003a8f262468b8b386ab63a557c159241d3a9199453d96b99361c8f13b89a5c5c594ce1fdf09a0edb3578848e50896d
SSDEEP

3072:PauqPxHzwZFTvv5VoZtqg2D/FXA+RegYsj8ILkfkxa9L7Vat:FqKZB8WX1AEJlj8ST4p7+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
712774cef7f33a2c8def72ecf27d2ce9_JaffaCakes118

Files

712774cef7f33a2c8def72ecf27d2ce9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7349ebea55c309b49931d42b83986f31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
VirtualFree
LoadLibraryA
GetExitCodeProcess
VirtualAlloc
VirtualProtect
GetProcAddress
GetModuleHandleA
VirtualQuery
GetExitCodeThread
HeapAlloc
ResetEvent
VirtualAllocEx
GetLastError
HeapReAlloc
LocalLock
VirtualLock
ReleaseMutex
GetProcessHeap
SuspendThread
WaitForSingleObject

user32

SendMessageA
ReleaseDC
IsWindowVisible
OpenIcon
LoadAcceleratorsA
LoadCursorA
GetDesktopWindow
GetDC
SetTimer
GetCursorPos

gdi32

CreateDIBPatternBrush
GetPixel

psapi

GetModuleInformation

msvfw32

DrawDibOpen
DrawDibClose
DrawDibEnd
ICRemove

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ