842585148e093a71815161953ebe4469_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

842585148e093a71815161953ebe4469_JaffaCakes118
Size

127KB
MD5

842585148e093a71815161953ebe4469
SHA1

f45398ecfb0eceb3aae4be8c47e3e230d126a35e
SHA256

6f455e8a12136cfbcf26b812330a6a1e256c3c6537e7578282852cdbfdfc09de
SHA512

6760e07409376089f18cf9331db3e70bd1aac0745461939d98ca0dc9de470242cca5dda5d2b7343d3c4c3e6e2f3c95723be71b20e078eb6c5eefd3609eb47b06
SSDEEP

3072:0nCbMPrV/5FH0YkFl7bm8GjH8wOD5aYJlVIK5Q7mJckEW:L8RrjUA8+Hj4a6fIKJJB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
842585148e093a71815161953ebe4469_JaffaCakes118

Files

842585148e093a71815161953ebe4469_JaffaCakes118
.exe windows:5 windows x86 arch:x86

5fa7740a4682fa10447a58bfe0458be8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
Thread32First
lstrcpyW
GetCurrentThreadId
GetModuleHandleA
GetProcessWorkingSetSize
GetSystemTimeAsFileTime
SetEnvironmentVariableW
ReadFile
GetThreadLocale
GetCurrentProcess
GetTempFileNameW
GetCurrentThread
GetCurrentProcessId
GetThreadTimes
CreateEventA
LoadLibraryA
GetSystemTime
DeleteAtom
VirtualAlloc
WaitForSingleObject
GetProcAddress
IsBadReadPtr
VirtualProtectEx
VirtualFree
Sleep
SystemTimeToFileTime

user32

CloseWindow
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
UpdateWindow
ShowWindow
MessageBoxA
CreateWindowExA
RegisterClassExA
LoadCursorA
LoadIconA

Sections

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ