88185f783488d3739a536645c041e25c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

88185f783488d3739a536645c041e25c_JaffaCakes118
Size

5KB
MD5

88185f783488d3739a536645c041e25c
SHA1

e3328b9a932cd13170c2c6848c8c684cdfc13fa8
SHA256

583dcba8fe910dffd313255e59724fc39436aae2e996f8e8c765c2b63377d32a
SHA512

6608554563f0f0e771d4987b5997f807e4f7410686f211d54d836557e303635cacfd831283a32577158ce23ada9d8b613775f97b73a71fef2008135fa577e8d6
SSDEEP

48:6J1b9tdETrxo63j253hrLSa61l31N1ujMlwhhUgaHlBB95VOMAXSmz+827:q1NET++jA3VLFjVh21vEs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88185f783488d3739a536645c041e25c_JaffaCakes118

Files

88185f783488d3739a536645c041e25c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

878276a9c7f7a6646cde6dc66579b25f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindowThreadProcessId
FindWindowA

kernel32

CreateFileA
ExitProcess
CloseHandle
GetFileSize
GetProcAddress
GlobalAlloc
LoadLibraryA
OpenProcess
GetExitCodeProcess
SetFilePointer
WriteProcessMemory
lstrcatA
lstrcpyA
ReadFile

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

urlmon

URLDownloadToFileA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 674B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE