efb0010f4200f69c444371bfec613cb0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

efb0010f4200f69c444371bfec613cb0_JaffaCakes118
Size

20KB
MD5

efb0010f4200f69c444371bfec613cb0
SHA1

73e6ca851636b9419937b6b70613a35325fedc66
SHA256

93e5d1ef40bbc88a6d460a1ec2315d3a91cb31dd5786ce1e352c4e78c032e2e3
SHA512

278a84c7abbe81bd752bd29e04917b82139dbb4f44317545c47647c47b27f7606b2352a7414f36c00a74702211e7e3e43fb3ae303b9770d80634db990bbb060e
SSDEEP

48:K0HHIZBiICiBi/Hdm0wNHZBwK6uZgpDMW5T61ocy/MW5T61mBjRSWTdePtboyl1c:TnI/1UvRwPBukg1Lhcy/L3tdePtboyn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efb0010f4200f69c444371bfec613cb0_JaffaCakes118

Files

efb0010f4200f69c444371bfec613cb0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0b24eacc6f38ea6965543369376a8743

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameA

kernel32

VirtualFreeEx
GetStartupInfoA
GetWindowsDirectoryA
Sleep
CloseHandle
OpenProcess
GetCurrentDirectoryA
CreateProcessA
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx

user32

EnumWindows
GetClassNameA

ole32

CLSIDFromProgID
CoInitialize

oleaut32

GetActiveObject

msvcrt

sprintf
__CxxFrameHandler
__set_app_type
_controlfp
_XcptFilter
_except_handler3
exit
_acmdln
_mbscmp
__getmainargs
_exit
_adjust_fdiv
_initterm
__p__commode
__p__fmode
__setusermatherr

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ