15d55f833cae5c004a997ad327e620bb_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15d55f833cae5c004a997ad327e620bb_JaffaCakes118
Size

6KB
MD5

15d55f833cae5c004a997ad327e620bb
SHA1

0821488a082f7bbb0ee9ba9abee08e0c55e295c8
SHA256

89e27f406ebf6b27f1db44c9bd39cfc0d0b7d009b006522dae6ee976cc33b768
SHA512

824cdf807992377dd099f3a0a3056f025f0bb0163dac98d12362eb3c9efa4970fee402309387f92d0ca3651d460b7aa245a34801a5d485c0e79308fe961daf14
SSDEEP

192:glKq2+PxHOsl5eGfFKdKtPsF7o77GQyn/:gUq2sB2sFK+py/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15d55f833cae5c004a997ad327e620bb_JaffaCakes118

Files

15d55f833cae5c004a997ad327e620bb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c9f4228fabf01f1e4168db0ad889bc3e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcessHeap
lstrcatA
GetProcAddress
SetEvent
GetModuleFileNameA
CloseHandle
lstrcpyA
ResetEvent
WaitForSingleObject
CompareStringA
ExitProcess
GetModuleHandleA
CreateEventA
LoadLibraryA
Process32First
CreateToolhelp32Snapshot
RtlUnwind

user32

GetForegroundWindow
IsWindow

advapi32

RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 942B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE