b163e7fe13817bafd912b6b8ae5dd889_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b163e7fe13817bafd912b6b8ae5dd889_JaffaCakes118
Size

77KB
MD5

b163e7fe13817bafd912b6b8ae5dd889
SHA1

e7a6804ba192d59ce14a6cd756478319efe877ef
SHA256

5470e2c1787e83dbba347b0eb6fbf8ba194a98b69e26cd2bb2980969aeb2b264
SHA512

a2a7f02f87adcdc15a2fa2f672659412059e78a287e5a2e206a9a434a59f87aea01636d907165f678da57d97594dd6ff7d66d042a96c7b04ec87cb979900f9ea
SSDEEP

1536:hZlDrVcHw2IphmjpLEmuQTfWSpz9ZkBjJtIWGg4m5e5xngc4VZ:vl3VcQphyOmFV9G5ZGW5eji

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b163e7fe13817bafd912b6b8ae5dd889_JaffaCakes118

Files

b163e7fe13817bafd912b6b8ae5dd889_JaffaCakes118
.exe windows:4 windows x86 arch:x86

31a29c11c09426dbc1c1bf2cd6557c1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memcmp
strstr
memcpy

user32

GetActiveWindow
DrawIcon
DestroyCaret
FillRect
GetMonitorInfoW
GetShellWindow

advapi32

ReadEventLogW
RegFlushKey
DecryptFileW
ReportEventW
OpenThreadToken

wininet

FreeUrlCacheSpaceA
GopherFindFirstFileA
GopherOpenFileW
FtpGetFileW
HttpQueryInfoA

Sections

.text
Size: 48KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE