14856aca7c5cc0ea89e26b5e448c0608_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14856aca7c5cc0ea89e26b5e448c0608_JaffaCakes118
Size

853KB
MD5

14856aca7c5cc0ea89e26b5e448c0608
SHA1

86865a044bbeb90890f7b7f6f498d73173e04971
SHA256

86ea532425ca349c8224fa56afbf3af41f4edf4ae80002bba3a1c3f732cd2d4b
SHA512

afcc956da5abf1633265eb8ef9de180d92eb7b4cb5b30c54d188f7de541ce20524b3ad205bcbf9084181d5c0d9f06899902f9d1a2a4391486a76f337b02f369e
SSDEEP

12288:kYZa4XenjfvZCHM2Xh3g5RkZlIJ08nF1ibjhtVW/u5QXnY3CHkHwVeRpRQsX6i9u:pJenLvZW11nZcfibjhtVWnXY3gFcZJU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14856aca7c5cc0ea89e26b5e448c0608_JaffaCakes118

Files

14856aca7c5cc0ea89e26b5e448c0608_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5177828b811ee3bb36c49429e5859c62

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SuspendThread
DeleteFileA
GetFileAttributesA
ReadFile
GetCurrentProcessId
IsBadCodePtr
FindAtomA
CloseHandle
GetProcessTimes
GetPriorityClass
GetStartupInfoA
DeleteAtom
GetModuleFileNameA
GetEnvironmentVariableA
HeapCreate
GetModuleHandleA
CreateMailslotW
GetCommandLineA
GetStdHandle
HeapDestroy

user32

GetWindowLongA
DispatchMessageA
GetKeyState
DestroyMenu
DispatchMessageA
GetClassInfoA
DrawTextW
GetWindowInfo
GetClientRect
CallWindowProcW
IsZoomed
SetFocus
GetSysColor
DestroyMenu

msctfp

DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow
DllCanUnloadNow

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 843KB - Virtual size: 842KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ