0fc75cda9497d2d738311cf45e5f988a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0fc75cda9497d2d738311cf45e5f988a_JaffaCakes118
Size

29KB
MD5

0fc75cda9497d2d738311cf45e5f988a
SHA1

17beaeb7b32006e8c6ffd7ef330aea7e7af33382
SHA256

928d7571bfa268bd56bb28e3dc5987dc0e4c0ea7136d378118ca20d1c8f9c26a
SHA512

b08f1ef04cc4726b3dd36c52466492db1edad0c8398992c553a8ae5f9348351bb413b3038871c46c88b308a3e4752b8a92d87077383a14e8302aca8b8b89cd19
SSDEEP

384:3KqXVIRP4r9ZLS/5ep0+fVId1HtejrTFOjvQzVrRAl26y8WNeyRny9vWw+TSncHk:RlGgDROQ+ZW4akH+T0Tr7bokIFC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fc75cda9497d2d738311cf45e5f988a_JaffaCakes118

Files

0fc75cda9497d2d738311cf45e5f988a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c2099ac5c4dac4d54a862930613477a6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
strncpy
strcmp
memmove
memcpy
_CIsinh
_CIcosh
strlen

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
GlobalFree
GlobalAlloc
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
HeapReAlloc
HeapAlloc
HeapFree

user32

CallWindowProcA
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
IsWindowEnabled
GetForegroundWindow
GetWindowLongA
SetWindowPos
EnableWindow
EnumWindows

comctl32

InitCommonControlsEx

ole32

CoInitialize

Sections

.code
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 21B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ