ef914d33e303c511111f07b458d74412_JaffaCakes118 | Triage

Sharing

General

Target

ef914d33e303c511111f07b458d74412_JaffaCakes118
Size

56KB
MD5

ef914d33e303c511111f07b458d74412
SHA1

1732ad0bf303f7f848f5ec8a45547db7584d607f
SHA256

c26f9555ad98cb2f8d80362681b2c04735f2b9bb6b58522bfb1d822057036e30
SHA512

f4adbd9ca081189c37d6eba747d405a193b1c45481c0aed7f2f138ebdb84dbc6bcd419e84b9c9fdfe40c10be555de16710312cf36b7c09a7ddccc1830683655d
SSDEEP

768:yrAYaCQKo+64VQ4VRfSO/dcgFtJDhuAhiDWxhVu3i/3K9LDnLg0P:ysYzyH4VtOG3CWLSi/cLb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef914d33e303c511111f07b458d74412_JaffaCakes118

Files

ef914d33e303c511111f07b458d74412_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37ab09a6edbf9fbf08aa53c4b4e64002

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
lstrcmpiA
VirtualAlloc
VirtualProtect
IsBadReadPtr
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetStartupInfoA

user32

DefWindowProcA
SetTimer
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
SendMessageA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA

msvcrt

_XcptFilter
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
free
_beginthread
_exit
malloc
exit
_acmdln
__getmainargs

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE