c26413866339f9fa5481ca81d69d2786_JaffaCakes118 | Triage

Sharing

General

Target

c26413866339f9fa5481ca81d69d2786_JaffaCakes118
Size

47KB
MD5

c26413866339f9fa5481ca81d69d2786
SHA1

f626bd14616244e27039b4fce3a37c07595a34e4
SHA256

74e09a7cc98c2138aa2c158f0877865c2928d5e37322c7444eb65eeb6967dc59
SHA512

443e3da037890c11ee8d7d6ac449ac1b9a86e0bc9b54d8b77d00bae39c8c1abc717c0f88389b39d34b26449a1ec6a1dd6e862eb3ee3e3623c335aebd66e88964
SSDEEP

384:dw0cbAUsKi3Bbh5vD91g/6e9JdYiTQH18eAHU6smAAcnZKh4lcW:i0HB3FHvvxe/dYpH187HEZA3y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c26413866339f9fa5481ca81d69d2786_JaffaCakes118

Files

c26413866339f9fa5481ca81d69d2786_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ed7dd473ec9f675bbb5722113dd5119e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
GetTempPathA
GetTickCount
GetSystemInfo
GetVersionExA
CloseHandle
WriteFile
MoveFileA
GetModuleFileNameA
GetCurrentDirectoryA
FreeLibrary
FreeResource
SizeofResource
LoadResource
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
Sleep
CreateFileA
ExitProcess

user32

SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
FindWindowA
PostMessageA
OpenWindowStationA

shell32

ShellExecuteA

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_strrev
_adjust_fdiv
_controlfp
__setusermatherr
_initterm
strcpy
memset
strlen
sprintf
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_acmdln
__getmainargs

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE