d3018217ad3f28c47c513ef3d2701c63_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d3018217ad3f28c47c513ef3d2701c63_JaffaCakes118
Size

10KB
MD5

d3018217ad3f28c47c513ef3d2701c63
SHA1

cb326e046c848a54b9c0d29be768209548d0fd4f
SHA256

678f5a79b539913c27eac7118dd7843967e3de54ac512ec81490de90d79daf40
SHA512

78624700dbd3e014d7024e5ea32f9056dcb9510865934f2253e913721388f6c322a226412e19b74ebaf9be881025dcb5974fce3ef055f6acd760b27c2f24cdb4
SSDEEP

192:ccXRdMGP9U34N6zJ5EU3dh6eJobNOJW8CKG:XXRdb1UQIPxobQCr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3018217ad3f28c47c513ef3d2701c63_JaffaCakes118

Files

d3018217ad3f28c47c513ef3d2701c63_JaffaCakes118
.exe windows:1 windows x86 arch:x86

251575623650bc933bad8739ca1c1602

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
Sleep
CreateThread
ExitProcess
VirtualAlloc
RtlMoveMemory
WaitForSingleObject

user32

MessageBoxA

ntdll

NtSetInformationThread
RtlDecompressBuffer

Sections

.code
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 390B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ