81cf374aee534fe4777494ec9a19a333_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

81cf374aee534fe4777494ec9a19a333_JaffaCakes118
Size

136KB
MD5

81cf374aee534fe4777494ec9a19a333
SHA1

227cd607b5973a674cb481b2a4b136c66eaebc6d
SHA256

a522099136d58c316ae7512826da0529c861af119fde8cf76a6d8c66c61d5519
SHA512

727ba2f5d5c55a24136962d625f2f23a91c967f25ee29742a21e449c8d69c40d9f837aed09e3931d096ac1faca9ba2c6178a2a6b034585bce3ad8cb49fe14edd
SSDEEP

3072:ZUpqusCKkqmMrxvA5aUNvF80B+rFi/O5yLWyWcFs8B:ZgqbDmMtKZv9B+rFkW9Is8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
81cf374aee534fe4777494ec9a19a333_JaffaCakes118

Files

81cf374aee534fe4777494ec9a19a333_JaffaCakes118
.exe windows:5 windows x86 arch:x86

378281524e8eddfa6d7281e60c6c7f27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CreateDialogParamA
LoadMenuA

kernel32

VirtualAllocEx
GetProcessHeap
ExitProcess
GetThreadContext
FindResourceA
SetThreadContext
WaitForSingleObject
GetCommandLineA
CreateProcessA
GetStartupInfoA
GetProcAddress
LockResource
GetModuleHandleA
CloseHandle
WriteProcessMemory
ResumeThread
CreateThread
HeapFree
HeapAlloc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE