a8c567f36d601ce1cce74f658f20b030_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a8c567f36d601ce1cce74f658f20b030_JaffaCakes118
Size

64KB
MD5

a8c567f36d601ce1cce74f658f20b030
SHA1

84ba38f9f5a16841d53ef90a2aa963eb9da27fe6
SHA256

d4af45d6b3cda3d6e92fa4c6c6d86ae20f4e9110240ce28242657104131841a7
SHA512

b57c31a869e321e072ec49a1e9575a7e3cf5ff7214d1a902991986e82b84f86748cab9588fbb78e32742735fd883b951455517237cdbdbc2ac8e1ce3eb3eefbb
SSDEEP

1536:mWXCSnHHJplN/daSDEk0rsYADstdfMbILipPHajoMsTgL5Ip5:zX7HNN/1/clADstCULsyUMmgGp5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8c567f36d601ce1cce74f658f20b030_JaffaCakes118

Files

a8c567f36d601ce1cce74f658f20b030_JaffaCakes118
.exe windows:4 windows x86 arch:x86

758b5de35c507ef2e6bb0d61dac243e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetCommandLineA
CreateConsoleScreenBuffer
GetProcAddress
InterlockedExchangeAdd
ExitProcess
GetEnvironmentVariableA
SetEnvironmentVariableA
GetLastError
GetModuleHandleA
GetStartupInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
RtlUnwind

user32

RegisterClassExA
LoadIconA
LoadCursorA
CreateWindowExA
GetMessageA
GetDlgItem
DialogBoxParamA

shell32

SHChangeNotify

shlwapi

StrChrIA

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE