efcc334b3aef5894996211e8d6919c96_JaffaCakes118 | Triage

Sharing

General

Target

efcc334b3aef5894996211e8d6919c96_JaffaCakes118
Size

59KB
MD5

efcc334b3aef5894996211e8d6919c96
SHA1

ff731aad54581a947be9d80b5320a4e0b5bd92a6
SHA256

4f8e06a512755ac7a5c37d86665eeb3af288ba0285363e38184e06b6cc914b5f
SHA512

3abc6d091bc1faf9ce697ec2482d7ceede555fce9dd5235c2f0ea0d2006db06c94d11236b2bdc9f86f92ec8fcd312b296fc7f8d9f54b6691844f7db83163a668
SSDEEP

1536:LWD5AiJr9TVR/gImUhkxHVPc6rKDpKJTgFdeXY2N:UOi59Tn/gImSkx1k6OD8R/Y2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efcc334b3aef5894996211e8d6919c96_JaffaCakes118

Files

efcc334b3aef5894996211e8d6919c96_JaffaCakes118
.exe windows:4 windows x86 arch:x86

878e245c2edf884a6d17d2acb4b6aef9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateProcessA
CreateThread
GetProcessHeap
GlobalAlloc
GlobalFree
LoadLibraryA
CreateFileMappingA
LocalUnlock
SetEvent
Sleep
TerminateProcess
VirtualProtect
WriteFile
LoadLibraryW

user32

ExitWindowsEx
GetMenuState
GetShellWindow
SendMessageTimeoutW
SetCursorPos
SetFocus

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 594B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ