a46e74037895e20599cb0b0f1bc83a1a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a46e74037895e20599cb0b0f1bc83a1a_JaffaCakes118
Size

436KB
MD5

a46e74037895e20599cb0b0f1bc83a1a
SHA1

1f38fc4036950beee26c88077835f331df89d9ec
SHA256

ef5c55793d8bb7634bfd36282f851d2ae987740014c26f552fa336c86de62a9d
SHA512

fcca4bd38b0da9d788fb44645b6075958eb2dc0113c6e67732dc210dad3a2ee37ae3a8983747b7304c0c521dc285dfdf44f8e1d4edf93122bcb0c90591cede99
SSDEEP

3072:9GFZppDfea3KJCzNTV0Zf74av9/e4J9oD2n1hgjb7Yi9KxlT1BTE:QFZppLe0KJCBTV2dexKhblT15E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a46e74037895e20599cb0b0f1bc83a1a_JaffaCakes118

Files

a46e74037895e20599cb0b0f1bc83a1a_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 428KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ