d586cbfd375110652f1f051ceaa2ff83_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d586cbfd375110652f1f051ceaa2ff83_JaffaCakes118
Size

7KB
MD5

d586cbfd375110652f1f051ceaa2ff83
SHA1

fa9bd3e039b1f6f6d96fb7e360cff40e9ecd09fd
SHA256

7e146c766aa3b6d7b88da616bccae3d7b1ac988336599e77c5bd75c3d3a79952
SHA512

0f5ecdfc052028c090976d5096eaf73aa8f8e6eed46f30b5a29e7d78fb783440f8bdd9fc8affdf0d28fe55dc735a0c607315b982e4797b8bb63a1f2e8119aebc
SSDEEP

192:yXRdMGP9U34N6zJqEU3d2AaBU7PaYtxJ:yXRdb1UQIc8wPaA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d586cbfd375110652f1f051ceaa2ff83_JaffaCakes118

Files

d586cbfd375110652f1f051ceaa2ff83_JaffaCakes118
.exe windows:1 windows x86 arch:x86

251575623650bc933bad8739ca1c1602

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
Sleep
CreateThread
ExitProcess
VirtualAlloc
RtlMoveMemory
WaitForSingleObject

user32

MessageBoxA

ntdll

NtSetInformationThread
RtlDecompressBuffer

Sections

.code
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 390B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE