fb501c461953f4a20d8f6fcdcfbc44b0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fb501c461953f4a20d8f6fcdcfbc44b0_JaffaCakes118
Size

436KB
MD5

fb501c461953f4a20d8f6fcdcfbc44b0
SHA1

650210cb07c82e185e135d8be6bcecb1afefe735
SHA256

fa26bc218f0e9eaaeaf3a24110742798c5f572fb6298e6ac2d7f519345520dea
SHA512

88eca128f92e419d85dd40b35b4ba57e0142208fc8f01a6e65774684c585033fb26783639b4a26055626cde47d7c991a5e5a5d5a746efff0ec109b5a66beab57
SSDEEP

3072:9GFZppDfea3KJCzNTV0Zf74av9/e4J9oD2n1hgjb7Yi9KxlT1BTy:QFZppLe0KJCBTV2dexKhblT15y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb501c461953f4a20d8f6fcdcfbc44b0_JaffaCakes118

Files

fb501c461953f4a20d8f6fcdcfbc44b0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 428KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ