956843888321a3ff02f23224d242c99c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

956843888321a3ff02f23224d242c99c_JaffaCakes118
Size

212KB
MD5

956843888321a3ff02f23224d242c99c
SHA1

1b273d7ed65954687953b3ddb746762984e184c2
SHA256

8fdb4dfcde1360fcdd37f27aa76b398bcf88eb94365d74aca57a05025e7014d8
SHA512

c21cef1bf846de0fac3a6acda3b7bfbac9a1ba0fe5c8160fe979416a0cad22c840f3faf70378a4076f5929eefc3b0b45e145f601912cfc0a30e8a9e1a15171ca
SSDEEP

6144:2iEml2J0h6SiCJ/S6bTWCVfvND2kYxgp4P4wzI:2JKOu6SNDTfVf3YxgWpc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
956843888321a3ff02f23224d242c99c_JaffaCakes118

Files

956843888321a3ff02f23224d242c99c_JaffaCakes118
.exe windows:5 windows x86 arch:x86

bc229d41fb00fa61f0d08895f9fd86dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
lstrlenA
GetCurrentThreadId
FindAtomA
WaitForSingleObject
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
lstrcmpA
GetTempPathA
ExitProcess
OpenProcess
GlobalAlloc
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualQueryEx
GetModuleHandleA
GetThreadContext
CreateProcessA
GlobalFree
TerminateProcess
ResumeThread
VirtualFree
GetLastError
VirtualAlloc
lstrcatA

user32

GetThreadDesktop
GetFocus
OpenInputDesktop
wsprintfA
EqualRect
IsWindowVisible
SetThreadDesktop
GetCursorPos
FindWindowA
InflateRect
ClientToScreen
CloseDesktop
GetWindowThreadProcessId

shell32

ShellExecuteA

shlwapi

SHGetValueA

advapi32

CreateProcessAsUserA
OpenProcessToken

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE