b46fbc1c58bf080e04c865a63e0f6a21_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b46fbc1c58bf080e04c865a63e0f6a21_JaffaCakes118
Size

257KB
MD5

b46fbc1c58bf080e04c865a63e0f6a21
SHA1

5190c6a15c271e89017c6ab7e360f21be4b3e196
SHA256

b2c74f69da312caba2e652d2570c9c21525c3a1b1da4dd85fdaecd853a8f0f0c
SHA512

5e86ce1ce2051356a406348bdf825bc5f51cf7f9717368fbc1416ab2927a3e308726769f5aa26e3c8f1a8a11474506e5d3212e21132ce3efb970e1b8573d7fdc
SSDEEP

6144:kuXniRcnW63w5HLUWyPTPcVH9AQfUjBdmrh7pX8tfoVjAf5b:ByRcnWdVLUrr059AEUjngh7pXyoV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b46fbc1c58bf080e04c865a63e0f6a21_JaffaCakes118

Files

b46fbc1c58bf080e04c865a63e0f6a21_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a6ed8ea118976d0b68c8dd51bac3dec0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetModuleFileNameA
Sleep
WriteFile
DeleteFileA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleHandleA
WaitForSingleObject
SetThreadPriority
ExitProcess
GetCurrentThreadId
TerminateProcess
OpenProcess
CreateEventA
OpenEventA
Process32Next
Process32First
CreateToolhelp32Snapshot
Thread32Next
Thread32First
GetWindowsDirectoryA
CreateFileA
GetFileTime
SetFileTime
GetCurrentProcess
CreateThread
CloseHandle

user32

GetWindow
FindWindowA
SendMessageA
GetWindowTextA
GetClassNameA
PostMessageA
MapVirtualKeyA
GetThreadDesktop
wsprintfA
EnumThreadWindows

advapi32

RegSetValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 252KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ