a2af0f679230e5baa6ab823b05d49188_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a2af0f679230e5baa6ab823b05d49188_JaffaCakes118
Size

88KB
MD5

a2af0f679230e5baa6ab823b05d49188
SHA1

48babf23648b213f7a337bbecf84f62a6f05d171
SHA256

75c2f6778e827109e3db029f01de1cac5ea9c8d85493760f723cfa33e2debccf
SHA512

59b24e5907a44e260ec0db914b33f1fe56365c876091f60f3e7f64211790322f6eeff2dd681a0418ceda8eacc0e280ca6d0bfcd8fe1600fa5e5013ca6a3b5897
SSDEEP

1536:PBroBKGIOWnToIfwzJTMm8jnOgQz/6gi9qUy7d+cyxgwPW:NoUkCTBfwzCVvQzyrxsdtWg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2af0f679230e5baa6ab823b05d49188_JaffaCakes118

Files

a2af0f679230e5baa6ab823b05d49188_JaffaCakes118
.exe windows:4 windows x86 arch:x86

60f1bcf3282e0a01e16db51b4b9512b4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
lstrcmpiA
VirtualAlloc
IsBadReadPtr
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetStartupInfoA

user32

DefWindowProcA
SetTimer
GetMessageA
DispatchMessageA
TranslateMessage
KillTimer
SendMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA

msvcrt

_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
malloc
_beginthread
free
_exit
exit
_acmdln
__getmainargs

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE