8e8f149a18d1f255beeca0e6926b1788_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e8f149a18d1f255beeca0e6926b1788_JaffaCakes118
Size

421KB
MD5

8e8f149a18d1f255beeca0e6926b1788
SHA1

a2d7d672dcc8dcde8afe76942873c033ca7120c8
SHA256

e8074499ab94b207dfae5925544f3c3a71de05200069e665eedebe17ed3f253b
SHA512

4626f7a15a563a6eaf8e5cb658cf8f1595fe20678fbc9d44408423e50316e6f8d99ca345b318bba8e7f52f0a076e700762f54f964e8ab671bf1345311a55e266
SSDEEP

6144:JIpWbSlVX+Ko3LJAFcGKh2Mu4m+3WzWGWYS3goje+uCraeQ6z:JIpYSODFqIDu4m2GWZ3fy2tR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e8f149a18d1f255beeca0e6926b1788_JaffaCakes118

Files

8e8f149a18d1f255beeca0e6926b1788_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d0148f5b902fe4e54712857e2723f339

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathCommonPrefixW
PathAddExtensionA

kernel32

LoadLibraryA
ExitProcess
VirtualProtect
CreateFileA
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 412KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ