8509cf46bf9f52806d3040ec1c0362ed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8509cf46bf9f52806d3040ec1c0362ed_JaffaCakes118
Size

210KB
MD5

8509cf46bf9f52806d3040ec1c0362ed
SHA1

2e8ff5a2435253875eac426f2e60d8478dd3cdc4
SHA256

aa34a2d591f62eed5a8cbd518cda87cefbb8b21c1467ba840493156cdf4fef29
SHA512

fc860e7801cb2528b096c8865c3d2b0d8e8f4507b23fcb5cf8cf6a1e999715f5600e0ea2318f939fe9b8e7794b223a4f9fd48b0b3e9e60b0d35a43fb631c9e12
SSDEEP

3072:I1q/hj+jnpxax2GsohMWYAV9/YiPQso5EZNYzfrZWpCComn4tR/C:I12anp4TjY5iPQsOUNeZWpIn/C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8509cf46bf9f52806d3040ec1c0362ed_JaffaCakes118

Files

8509cf46bf9f52806d3040ec1c0362ed_JaffaCakes118
.exe windows:5 windows x86 arch:x86

606297d1078daae1327862947df89355

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
lstrcatA
lstrcpyA
FindAtomA
WaitForSingleObject
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
lstrcmpA
GetTempPathA
ExitProcess
GetLastError
GlobalAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualQueryEx
GetModuleHandleA
GetThreadContext
CreateProcessA
GlobalFree
TerminateProcess
ResumeThread
VirtualFree
lstrlenA
VirtualAlloc
OpenProcess

user32

OpenInputDesktop
wsprintfA
ClientToScreen
GetThreadDesktop
GetFocus
GetCursorPos
SetThreadDesktop
InflateRect
FindWindowA
IsWindowVisible
EqualRect
CloseDesktop
GetWindowThreadProcessId

shell32

ShellExecuteA

shlwapi

SHGetValueA

advapi32

CreateProcessAsUserA
OpenProcessToken

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 186KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE