af7b8d7bf8d5c746dc3ef456ff9efe4c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

af7b8d7bf8d5c746dc3ef456ff9efe4c_JaffaCakes118
Size

163KB
MD5

af7b8d7bf8d5c746dc3ef456ff9efe4c
SHA1

84975f652c2e531b7eab11aaa0bd53c1e7d5c6ca
SHA256

2bb9d82c04f1da400335d1c16a8d4f07a5998489f941973b8cf4aca0ff65a6f0
SHA512

1f58564a2ae9f51d49414f98cefd84fd1f8ce84cd3489626206dbe9acf8f877df5b04b389650a20311873f1f7cbe38153f8cbac7f09570f7cc6e18a46d6570cc
SSDEEP

3072:rJHC5enIiFTsRxpSmRD4vB2v8BUBbu9jsMfgq:rJHC5enbFTIQmB4Z2vOqssV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af7b8d7bf8d5c746dc3ef456ff9efe4c_JaffaCakes118

Files

af7b8d7bf8d5c746dc3ef456ff9efe4c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8e60dc772cd183279b7b57e98032d9ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
OpenProcess
GetStartupInfoA
MulDiv
VirtualAlloc
RtlMoveMemory
GetWindowsDirectoryA
GetCurrentThreadId
VirtualFree

user32

CharNextA
GetDesktopWindow

Sections

.text
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Mmlqpwrs
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ