891edcfc52b66394e49faf8dd9bfe928_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

891edcfc52b66394e49faf8dd9bfe928_JaffaCakes118
Size

420KB
MD5

891edcfc52b66394e49faf8dd9bfe928
SHA1

2994fa638517f54b7dd99f1e550364ccabe7763c
SHA256

fa148e9af8378928358559c5b2a03b9a4ef1d2d9afab45fdd625df06e124ef06
SHA512

6c8ef5b0369cca1d5592ba465e5e29effcdd26a4bbaf52b0c2e865eb5bbbcea923400ced85f87e632370497c635f18caf5d1d0f40b80571878288ba713d3ae89
SSDEEP

6144:iJlnLiSfOqz3uU7tYcFYL0NtSGPl26iya/iO5AmT8O2u7Oe03mijeX+3KwQ0:iJhGO3X7tYcttSMllsH516+y1jeYKwz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
891edcfc52b66394e49faf8dd9bfe928_JaffaCakes118

Files

891edcfc52b66394e49faf8dd9bfe928_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ