893945b99509ab7c2fc6c37624c3bbe5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

893945b99509ab7c2fc6c37624c3bbe5_JaffaCakes118
Size

114KB
MD5

893945b99509ab7c2fc6c37624c3bbe5
SHA1

b93d752b129b0a537cf8fdfea86a14df395eb390
SHA256

a7c631c57ec4690fad6cb85f12af53423050864ac242427053f465e175d6d92f
SHA512

cf7b20d8255835410f71b86b6a3e983d99eade3f6232d5c99d22f94122015fc0005a01f7cc8f4afaf635227d9f36fae1d334f7e9a3f86c72af6aa5c1fdba52e8
SSDEEP

3072:ohLtP5l5DlvB7Bv0a05l7xM/nr90icAm7:mB7l0a05TM/r9nm7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
893945b99509ab7c2fc6c37624c3bbe5_JaffaCakes118

Files

893945b99509ab7c2fc6c37624c3bbe5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9d412cc7326d0752bfaad98c5afcd6a1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileSize
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
CreateFileA
CreateSemaphoreA
VirtualProtect
GetCurrentProcess
VirtualAlloc
VirtualFree
LocalFree
LockResource
LocalAlloc
LoadResource
FindResourceA
VirtualAllocEx
CreateEventA
SetEvent
ExitProcess
GetModuleHandleA
Sleep
DeleteFileA
WaitForSingleObject

user32

SendMessageA
FindWindowA

Sections

.text
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ