ceec04eb27256ef76558e09c8d69b2b0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ceec04eb27256ef76558e09c8d69b2b0_JaffaCakes118
Size

8KB
MD5

ceec04eb27256ef76558e09c8d69b2b0
SHA1

97e7fb10512b58e3324599071430b9daecfe89fc
SHA256

f9d61da09b2a91d7683324e15b66391676b8650d9c871521587572a553da7093
SHA512

7c10d4a96f489287245d4b09c0052c34028546215f5f576fbdee6d9edcdb21a9725fa6b1f6f3153568f2e4d6e8108c51ecde75832988a66c0ea694fee5a02030
SSDEEP

192:g6SciokygyGCKUbufKQh3B0JTpo8jITs+/v8e:tDayjKEfITs+vJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceec04eb27256ef76558e09c8d69b2b0_JaffaCakes118

Files

ceec04eb27256ef76558e09c8d69b2b0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4dbf7b64da4c9ebbca49b1ca2021681a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
WideCharToMultiByte
lstrcpyA
lstrcatA
CreateEventA
WaitForSingleObject
VirtualQuery
CloseHandle
FreeLibrary
PulseEvent
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
InterlockedExchange
GetProcessHeap

user32

DestroyWindow
MsgWaitForMultipleObjects
PeekMessageA
DispatchMessageA
TranslateMessage
CreateWindowExA
GetForegroundWindow
ShowWindow
BeginPaint
EndPaint
GetDesktopWindow
AnyPopup

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 236B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE