050e9b8b544045067a085ef5785049d2_JaffaCakes118 | Triage

Sharing

General

Target

050e9b8b544045067a085ef5785049d2_JaffaCakes118
Size

61KB
MD5

050e9b8b544045067a085ef5785049d2
SHA1

2e7fc8386bd243516ffee662c6327d3dc393bee6
SHA256

aabc81f03c54a1076d751e745abaf31ebfe53d8ff03c7c8ec8431d6510b0149e
SHA512

652ff177db4fd968aec036f87b50bb968913edd781c7cdd36b8f6b3d1ab0a23f07293995eb83332f644b6636f53561fd9dd5f45f0495a9ac9eb79a5d5f4380f3
SSDEEP

768:UmFWW2Q6zCmwf6ptcRa0m6AtsXbVcOmVx8pDu2JNWb8tcKt8ZNv8Gv2Qmb05:UtJNS2CY0mFabVr88BBJNQ89+5v2Qkw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
050e9b8b544045067a085ef5785049d2_JaffaCakes118

Files

050e9b8b544045067a085ef5785049d2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d830a63eadd38e1572722534821e9799

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
ReadFile
GetConsoleAliasesLengthA
VirtualProtectEx
ExitProcess

user32

GetTopWindow
MessageBoxA
SendMessageA

Sections

CODE
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.kkychq
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.byeyhq
Size: 53KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ