123ccc626cd5980e942a7a15f695b107_JaffaCakes118 | Triage

Sharing

General

Target

123ccc626cd5980e942a7a15f695b107_JaffaCakes118
Size

76KB
MD5

123ccc626cd5980e942a7a15f695b107
SHA1

a3eecb3b8e73e9561a7e3473518963a925ef0650
SHA256

e1843c934a21b8c997747359ce84560ba6249e9a9948880b6c86c5dd68418c57
SHA512

8a8940292e831fa1e9e0f8e206e966209025540015b07220068413704b5c857078fd8ac603da59d3e49e71f53b7c98d43f007840d1d00703ae927115f6faaa0c
SSDEEP

1536:v4C/mlUsTM4LDkOHrPKgANo7Tnal9rI+UZm5y3GiKtK3cYY:wJ3RHrPbANqa7rI+V03GiOipY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
123ccc626cd5980e942a7a15f695b107_JaffaCakes118

Files

123ccc626cd5980e942a7a15f695b107_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebdf111d94cfe74f9b72d32600e01ce0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
GetProcAddress
LoadLibraryA
GetComputerNameA
GetWindowsDirectoryA
VirtualProtect
GetCurrentProcess
GetSystemDirectoryA
LockResource
LoadResource
GetCurrentDirectoryA
CreateMutexA
LocalFree
GetCurrentProcessId
ExitProcess
CreateEventA
VirtualAlloc
GetVersionExA
LocalAlloc
GetCurrentThreadId
FindResourceA
GetCurrentThread

advapi32

GetUserNameA

user32

GetForegroundWindow
GetActiveWindow
GetSystemMetrics

msvcrt

memset
memcpy

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ