adb848d7963211f8f15f61b8acd04ce5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adb848d7963211f8f15f61b8acd04ce5_JaffaCakes118
Size

7KB
MD5

adb848d7963211f8f15f61b8acd04ce5
SHA1

b82313c92b2a5b3d5218671451ca9e194763ddf0
SHA256

56634c680e66f8f056133462091b56971ab8b623641d26eb0493d1f27428441c
SHA512

e1b9f55dd93c3f59a02baf9513eefc7b3286e91ef5657d3197ba6944eea9d0ddb4b1019046c122462327bb73b0ed336e44cb83f4cff33e360daaca47dc1c1b5c
SSDEEP

96:Fqa+xOrShHZJsyM3AnC5E4KSjajvNzYchp0jr3y1RHV3Iddr/vcOmi:1+xB5syGPvKSGv+Sp0jLyjBId9/v8i

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adb848d7963211f8f15f61b8acd04ce5_JaffaCakes118

Files

adb848d7963211f8f15f61b8acd04ce5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e9202821e39477bfacecf3923622f44

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
WideCharToMultiByte
lstrcatA
VirtualQuery
InterlockedExchange
CreateEventA
WaitForSingleObject
CloseHandle
GetModuleFileNameW
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
GetProcAddress

user32

GetForegroundWindow
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 124B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE