a1b78f2498efb315f3bb39326d54a6e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a1b78f2498efb315f3bb39326d54a6e3_JaffaCakes118
Size

21KB
MD5

a1b78f2498efb315f3bb39326d54a6e3
SHA1

e857099e7eb9b5527e795374307317343d3c2046
SHA256

13b04254da2f61c9db53dc010bfbd8d8ec597b66d540242a38d7a24d8f3fb7da
SHA512

b83604b0bd6798dff514f20fbb7899a685b1262030bd8dd5c08f51e3c10a3224bec675ad52583d9676b039863193043c002e4b02ce405ade0cba9769ce92e19e
SSDEEP

384:pfpPeE9bS4XX2oTQI4UMZx1qsPappJWK8g+7vTLv3yCAxvt00J3D:pZeEL2I4RPa/JWK8g2r73yC+3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1b78f2498efb315f3bb39326d54a6e3_JaffaCakes118

Files

a1b78f2498efb315f3bb39326d54a6e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

1e29db8235caca9bd2a89fe8e1a122c9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA

kernel32

GetCurrentProcess
TerminateProcess
GetSystemInfo
DeleteFileA
SetUnhandledExceptionFilter
CreateFileA
MapViewOfFile
UnhandledExceptionFilter
GetVersionExA
LCMapStringA
CreateFileMappingA
CloseHandle
GetOEMCP
GetWindowsDirectoryA
GetTempPathA
UnmapViewOfFile
IsBadReadPtr
GetEnvironmentStrings
GetLastError
IsDebuggerPresent
FreeEnvironmentStringsA
IsBadWritePtr
GetSystemDirectoryA
ExitProcess
LocalFree
FormatMessageA
ReadFile
VirtualAlloc
GetModuleHandleA

user32

CreateWindowExA
MessageBoxA
wsprintfA
GetParent
EnableWindow
GetWindow

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ