d57b1ff018ea0cde8902f4dcbd433020_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d57b1ff018ea0cde8902f4dcbd433020_JaffaCakes118
Size

238KB
MD5

d57b1ff018ea0cde8902f4dcbd433020
SHA1

f8a9a70331d1d639199505217b829c604e023816
SHA256

e841807b1c4816220404d064cb6b719272deaecf6b028e885ad3535c53a4bb1e
SHA512

0259fb2750ea48f201cd30d2ea22885cc389cc81d11c4136f1c66eabf4b7cd06fd4c19eb0707e3ab531d75386edba21562217af43ed9f859c9c1d28e63442053
SSDEEP

6144:6bi5/PtiuSGilYXzONDBGHU8tga0WUhlY5OK0uY0jypEXs:6OHGGilKONUUNa0fbYtY0jye8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d57b1ff018ea0cde8902f4dcbd433020_JaffaCakes118

Files

d57b1ff018ea0cde8902f4dcbd433020_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8a8256941f642d7feba57cf5557a2d05

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualProtect
LoadLibraryA
GetProcAddress
VirtualAlloc
Heap32First
Heap32Next
WriteFile
GetEnvironmentVariableW
Heap32ListFirst
Sleep

user32

PostMessageA
GetMessagePos
GetInputState

ole32

CoUninitialize
OleInitialize
CoInitialize
CoInitializeEx

advapi32

RegQueryValueExA

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 209KB - Virtual size: 209KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE