a9f82694a77d71801763589cb66f4399_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a9f82694a77d71801763589cb66f4399_JaffaCakes118
Size

77KB
MD5

a9f82694a77d71801763589cb66f4399
SHA1

2f7285f450dd96185f3992706b5e159f8d61f843
SHA256

537b93e386b59cd85988448c7f89198797e8d372a49983accac5344c7eb24929
SHA512

d2c8f1e15e51eadde33f2fcf065de950e1225bed2d2270166060c3e03037bfda98926d1231b1b07406038f25b0e8979ee0f96fe8577a97ec95d046ddfe16dae2
SSDEEP

1536:vv0WzZ7UDVhcPF2V8zqsFzcUw+7CVWlNg4lrbqCF5pxf22c3+b:vBUDVhcPF2mesBS+7CVYrz122cub

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9f82694a77d71801763589cb66f4399_JaffaCakes118

Files

a9f82694a77d71801763589cb66f4399_JaffaCakes118
.exe windows:4 windows x86 arch:x86

31a29c11c09426dbc1c1bf2cd6557c1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcmp
strstr
memcpy

user32

GetActiveWindow
DrawIcon
DestroyCaret
FillRect
GetMonitorInfoW
GetShellWindow

advapi32

ReadEventLogW
RegFlushKey
DecryptFileW
ReportEventW
OpenThreadToken

wininet

FreeUrlCacheSpaceA
GopherFindFirstFileA
GopherOpenFileW
FtpGetFileW
HttpQueryInfoA

Sections

.text
Size: 48KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE