8e2603c1ffcdfbe90d0cf260e800b386_JaffaCakes118 | Triage

Sharing

General

Target

8e2603c1ffcdfbe90d0cf260e800b386_JaffaCakes118
Size

46KB
MD5

8e2603c1ffcdfbe90d0cf260e800b386
SHA1

4dcac39098777d9a8aaabf522d204b8115d6fb4d
SHA256

696b1db261a808fbcda34891bf0d51e95168957b672a12f2db4fe12f2a44b9bb
SHA512

691eb3ff20856c637c0dab8b2810ff7eec10cb7a3db419c66c16ce8832e0cdb455144c7de3117cbe06a5ffb0b3ca058968c883c50881f2bbaa23fedaed848ead
SSDEEP

768:Sf4v44KUh10tSQV4y+48R5J0YT7WGIYHsq0X5zxIPyJmHQ:Sf4v8w0wQVoR5WYTS7YyrEw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e2603c1ffcdfbe90d0cf260e800b386_JaffaCakes118

Files

8e2603c1ffcdfbe90d0cf260e800b386_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d434792acab0aa919b992da582ee181d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
SizeofResource
FindResourceA
LockResource
VirtualFree
FreeResource
ExitThread
GetProcAddress
FindAtomA
GetModuleHandleA
AddAtomA
VirtualAlloc

user32

UnregisterHotKey
WindowFromPoint
TranslateMessage
WaitForInputIdle
UnregisterClassA
UnpackDDElParam

advapi32

RegLoadKeyA
RegCreateKeyA
CryptReleaseContext
CryptCreateHash

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 694B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 95B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ