f527ca1cfc6ed5a54913d01da70c836b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f527ca1cfc6ed5a54913d01da70c836b_JaffaCakes118
Size

8KB
MD5

f527ca1cfc6ed5a54913d01da70c836b
SHA1

b08a3bea1f7d0d9c967ca922f4f269347a5d9eac
SHA256

700badcca5fe303fcbc18921a2b549bae6fe36a32a3558359013752734c143a8
SHA512

2adc8b498b59e6e6084bca4960ae9bd9e387e5e3e109d44d88886eaf0f9f8d198bbda4748cf40ba8105c328cd5948f92f9353cf82f294356efdf5256a26bd0a5
SSDEEP

96:flkplzf9EOyvmxUUMDmk8nRDgTXQOMV9GGYqs9pv0:WfWTURm8RDSXQOOGQs99

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f527ca1cfc6ed5a54913d01da70c836b_JaffaCakes118

Files

f527ca1cfc6ed5a54913d01da70c836b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

173ee9aff53359e930af16e24712c9fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

RtlCaptureContext
RtlAdjustPrivilege
VerSetConditionMask
RtlZeroMemory
RtlUnwind
RtlMoveMemory
RtlFillMemory
RtlCaptureStackBackTrace

kernel32

lstrcmpiA
TerminateProcess
SleepEx
SetNamedPipeHandleState
SetFileAttributesA
GetProcAddress
CreateFileA
CreateToolhelp32Snapshot
ExitProcess
FreeEnvironmentStringsA
GetCommandLineA
GetCurrentProcess
GetHandleInformation
GetLastError
GetModuleHandleA
GetNativeSystemInfo
ReadFile

user32

RegisterClassA
CreateWindowExA
CallWindowProcA
MessageBoxA
GetCaretPos
SetClassLongA
FlashWindow

advapi32

RegSetValueExA

opengl32

glPushName
glPushMatrix
glTexCoord1d

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE