ab2cbdb5f07200bde026dcbf4b1cf169_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ab2cbdb5f07200bde026dcbf4b1cf169_JaffaCakes118
Size

225KB
MD5

ab2cbdb5f07200bde026dcbf4b1cf169
SHA1

45b78650e9a4e95b44ef6119f04bee3e1412ef80
SHA256

c7db6690134e9acb15fd55d11b9949b9910de3f3b3c6918af57fef5dbbf26f2b
SHA512

efecf1aa882c562e1411be9c472afce2b7a39e77d3da1051c4911f0678112186d5d4913d15798617d1a0156d14137e19a92bb6cb34f777718d38ffc8ec0f388d
SSDEEP

6144:fjKAcPyQ+h4bbNR9ZXEUcOFBFJPtgvs0cv1QZ6j:+AcPyBqbbN3ZUqBFJVEPcA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab2cbdb5f07200bde026dcbf4b1cf169_JaffaCakes118

Files

ab2cbdb5f07200bde026dcbf4b1cf169_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99e6ec0c348508c7e65cbbb91cd3cdd5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

lstrcmpiA
GetModuleHandleA
LeaveCriticalSection
InterlockedIncrement
TerminateProcess
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
GetCommandLineA
GetProcAddress
WideCharToMultiByte
VirtualProtect
GlobalFree
Sleep
GetTickCount
SleepEx
RemoveDirectoryW

user32

SetWindowLongW
ValidateRect
PtInRect
PeekMessageA
PostThreadMessageW
SetWindowsHookExA
GetParent

advapi32

RegOpenKeyExW

msvcrt

__setusermatherr
_initterm

ole32

CoTaskMemFree

gdi32

GetObjectW

Sections

.text
Size: 222KB - Virtual size: 221KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 1010B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 942B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ