ade99634281a97b1b1f269d06f5ec7fa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ade99634281a97b1b1f269d06f5ec7fa_JaffaCakes118
Size

24KB
MD5

ade99634281a97b1b1f269d06f5ec7fa
SHA1

28df710105615455bbb994501335a68c57c1f6e0
SHA256

ca5362255a426e5e54bbd32a8c539766eb7bc0f4f2080ea8533ef8616a4dbe1b
SHA512

5ad6d06120449d373a80930a6d54091ca478e134cc57170839939cb74996839d721e89dc70938dc78ece346ee04d6a50ac3b8213ff10cc2b2ac03694605f600e
SSDEEP

384:Ro2rnhh2tMYVPyIeOHQbLvPpavQybTwspwilcrVH2c5:Ro2jhhqMaaDAlc5P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ade99634281a97b1b1f269d06f5ec7fa_JaffaCakes118

Files

ade99634281a97b1b1f269d06f5ec7fa_JaffaCakes118
.exe windows:5 windows x86 arch:x86

3b72c08b56dead13e86b16dd264d62b1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

wsprintfA
MessageBoxA
EndDialog
SendMessageA
DialogBoxParamA
LoadIconA

kernel32

CreateFileA
GetFileSize
ReadFile
IsBadReadPtr
GetModuleHandleA
LocalSize
RtlMoveMemory
CreateProcessA
GetThreadContext
ReadProcessMemory
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
SetThreadContext
ResumeThread
HeapFree
CloseHandle
GetEnvironmentVariableA
TerminateProcess
lstrcpyn
GetProcessHeap
ExitProcess
HeapAlloc
WaitForSingleObject

comctl32

ord17

ntdll

ZwUnmapViewOfSection

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE