14f542a185b328ffda13271818ec14e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

14f542a185b328ffda13271818ec14e3_JaffaCakes118
Size

436KB
MD5

14f542a185b328ffda13271818ec14e3
SHA1

b157e559d6ddbea46b39cce5b8557bb17112d460
SHA256

d1955de0b1252d73edcc40062ec2eb4a8a8f8c12e9d02bf1bf46f2b852ebbee9
SHA512

b1e838abb3bf88ac4c0e146e3f3e811bcfe768801cddc1fb37970dd4530394e3c58fb5f30f53f6606fb9b66dd05eb11bfb9f8e232e5eaeb6e974b750b646cb9a
SSDEEP

3072:9GFZppDfea3KJCzNTV0Zf74av9/e4J9oD2n1hgjb7Yi9KxlT1BT3:QFZppLe0KJCBTV2dexKhblT153

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14f542a185b328ffda13271818ec14e3_JaffaCakes118

Files

14f542a185b328ffda13271818ec14e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 428KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ