8e37a686345eb5bd8d07164a05df558a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e37a686345eb5bd8d07164a05df558a_JaffaCakes118
Size

80KB
MD5

8e37a686345eb5bd8d07164a05df558a
SHA1

91b2cf467963127f04577fd65b084d1258f34ef1
SHA256

8418adbcaf74572eb6fbf3f564bd24612f37d16c7dc3116f9bbad406627e3540
SHA512

653327d5b5da47e52d90fb9736a7ce76c51145622e2e32bdf6fbf8da484b7c08159fd3dfc0f722c6514ca72cc530321f335bf8fd19751d2c90c6d26676418d3b
SSDEEP

1536:xbmkpWwmBtq8YIwbBiTIO0BX/QbjoCm1sx6skv5dC:xbmTq8Y/l3BoHQ1sIx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e37a686345eb5bd8d07164a05df558a_JaffaCakes118

Files

8e37a686345eb5bd8d07164a05df558a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bbc950ae51956b07d916aa5c988c0655

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
CreateEventA
LocalFree
ExitProcess
SleepEx
GetCurrentThread
GetCurrentDirectoryA
CreateMutexA
GetCurrentProcess
GetStdHandle
GetWindowsDirectoryA
LocalAlloc
GetComputerNameA
GetSystemDirectoryA
VirtualAlloc
GetVersionExA

advapi32

GetUserNameA

user32

GetForegroundWindow
GetSystemMetrics
GetActiveWindow

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 990B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ