f685d5222fd8851bc497cafb5eeeeff5_JaffaCakes118 | Triage

Sharing

General

Target

f685d5222fd8851bc497cafb5eeeeff5_JaffaCakes118
Size

8KB
MD5

f685d5222fd8851bc497cafb5eeeeff5
SHA1

74a3e17aeda4743c690177f018daff3d0080621c
SHA256

cdbbc456d5d746f74fe7dec47eba039dc3adde187fa10484c51cf4785e264c7f
SHA512

19573775c0dffb85fdad85a26d10b0ee5cb82e401eb42a211e06e576dd315486a3dd60d330c5391eee6025d6de04c9fa6008a4a1b28605e8de35ed592c724821
SSDEEP

192:YU0WN4zZians3scKGWJqUr/ku6JPSukLZh/y2Y/G7W+:t0B9iHc1G3UrSSr5Y/G7W+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f685d5222fd8851bc497cafb5eeeeff5_JaffaCakes118

Files

f685d5222fd8851bc497cafb5eeeeff5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1cb305a9a27e52ff74d986a2db56dcfc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
lstrcpyA
CreateProcessA
GetCurrentProcess
GetStartupInfoA
GetCurrentThreadId
GetCurrentProcessId
CancelIo
GetProcAddress
FreeLibrary
GetACP
GetCurrentThread
LoadLibraryA
lstrcatA
GetTickCount
MoveFileExA
GetThreadPriority
CreateFileA
lstrlenA
GetTempFileNameA
CreateDirectoryA
Sleep
lstrcmpiA
DeleteFileA
ReadFile
SetFilePointer
GetFileSize
GetSystemDirectoryA
GetModuleFileNameA
GetTempPathA
GetShortPathNameA
GetLastError
CreateMutexA
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
ExitProcess

user32

GetActiveWindow
SetActiveWindow
GetCapture
wsprintfA
GetTopWindow

gdi32

GetBkMode
GetBkColor
CancelDC
GetBrushOrgEx
CreateCompatibleDC
CreateCompatibleBitmap

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 54B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE