d16e1163f6e93644b1d1c562dab5a45b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d16e1163f6e93644b1d1c562dab5a45b_JaffaCakes118
Size

92KB
MD5

d16e1163f6e93644b1d1c562dab5a45b
SHA1

10872005c09c1c45b819b93600986480b39a8b6c
SHA256

2ad4705ba98b40abf1bfb1478e6ad37bebb269ab99fd64f6f1157bc1a4e12d58
SHA512

70d1887fdd0f8c2ae89ea86f673fd62a6b0cc6f3b8dde9c8afd245f513b73e06a4b00a405170eb3d0541ca2078435a71a4251ce94d54c08497d2532e181c6f0b
SSDEEP

1536:fb/GnmjKEgN55G43PXe1mCZSg4duPOKRayU06Q44iR8MQKoB0Bu1I5:fbl9+5V3/e1gYtjU5Q44iCJGBh5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d16e1163f6e93644b1d1c562dab5a45b_JaffaCakes118

Files

d16e1163f6e93644b1d1c562dab5a45b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c05b08200dd675988ae542628c2ae79f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThreadId
MultiByteToWideChar
SizeofResource
GetVersion
GetTickCount
FindResourceW
SuspendThread
CreateProcessW
lstrcpyW
LockResource
GlobalAddAtomW
SetFilePointer
GetCurrentProcessId
GetLocalTime
GetCurrentProcess
SetWaitableTimer
GetProcAddress
ReadFile
MoveFileW
CreateWaitableTimerW
LoadLibraryA

user32

GetWindowDC
GetKeyState
DialogBoxParamW
GetWindowTextW
EndDialog
PostQuitMessage
SetForegroundWindow
RegisterWindowMessageW
SetCursorPos
SetCapture
GetParent
RegisterHotKey
DefWindowProcW
GetDlgItem
LoadIconW

gdi32

CreateICW
MoveToEx
CreateCompatibleDC
BitBlt
Rectangle

advapi32

RegNotifyChangeKeyValue
LookupAccountSidW
RegCloseKey

Sections

.lpute
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.dibiu
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fkmovi
Size: 4KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE