a462eafa174dc92c285401941e0c85c1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a462eafa174dc92c285401941e0c85c1_JaffaCakes118
Size

5KB
MD5

a462eafa174dc92c285401941e0c85c1
SHA1

2044370cf8a17948f020315270a552456daa5e25
SHA256

6f9ce9a26bf2c77e0dd5fd63fe896829bbe6c800aaa244c318ae95afb11e4123
SHA512

53a26cd7910f569f793f1469da1ed2c5c3bf531bf5d62715487e52e68c54d247eb6ce20470d5815ad8c26e400c6f3815930a9f845213ef1191f3b672c5457cbf
SSDEEP

96:WXT05wTetJB0icUox+DsL29FOC55DyULhGC3QagoqX:WDWwTe0icUogDaULoC3aZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a462eafa174dc92c285401941e0c85c1_JaffaCakes118

Files

a462eafa174dc92c285401941e0c85c1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bf3faad560b4c2ffa9363f51fd9791b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA
MessageBoxA

kernel32

HeapAlloc
CreateProcessA
WaitForSingleObject
CloseHandle
OpenProcess
GetModuleHandleA
VirtualFreeEx
RtlMoveMemory
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetProcessHeap
ExitProcess
GetModuleFileNameA
HeapFree
GetStartupInfoA

urlmon

URLDownloadToFileA

msvcrt

modf
_ftol
sprintf

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE