b090433f027cfab76727493ef861f6ef_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b090433f027cfab76727493ef861f6ef_JaffaCakes118
Size

239KB
MD5

b090433f027cfab76727493ef861f6ef
SHA1

fe08b9e21cfdd477815a855695742f0fb97b01fc
SHA256

3c82b6261f360110c13f1dbc25c7ba5fabcf938fb03fb5e653b5f86dee4d58ec
SHA512

1d58113e2c6b3f2b97a92f2081c3dc838e7ceeffe3c1a02a49911b20337ed307e78f9f032a3388b87f756d626d7f3a48853332aeb36848e57bbb2ab42ad5fca4
SSDEEP

6144:f2ceWnCCddHcma05vvhdOZyrLCtGnlpC:+ceWFDXWZ6UGC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b090433f027cfab76727493ef861f6ef_JaffaCakes118

Files

b090433f027cfab76727493ef861f6ef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ef4729a66c398f2cc1415670d297ce64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
DeleteFileA
GetWindowsDirectoryA
GetCurrentProcess
SetFileTime
GetFileTime
ExitProcess
LoadLibraryA
GetModuleFileNameA
Sleep
LockResource
LoadResource
SizeofResource
WriteFile
WaitForSingleObject
SetThreadPriority
CreateThread
GetCurrentThreadId
TerminateProcess
OpenProcess
CreateEventA
OpenEventA
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
CloseHandle
GetModuleHandleA
FindResourceA

user32

GetWindow
FindWindowA
SendMessageA
GetWindowTextA
GetClassNameA
PostMessageA
MapVirtualKeyA
GetThreadDesktop
wsprintfA
EnumThreadWindows

advapi32

RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ