15dd8f04dd60b4c2d45bb486279ba8a9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15dd8f04dd60b4c2d45bb486279ba8a9_JaffaCakes118
Size

814KB
MD5

15dd8f04dd60b4c2d45bb486279ba8a9
SHA1

4880b11c65531219e4a56a9c4223fba186dba2cb
SHA256

620f11171db401478b9b65c8467bd1ff171ada4d9a163c0c0c8fb995032b1bd3
SHA512

9a34f95d1e4628a851d24b3c4d7096cf7be93cced061d50d5ee00d5c47e36e75177316d72c0bd434f9c85f5074e358a063b877b307613579cc3aa959a31b78e7
SSDEEP

12288:sOwtp8drcn+mYUG3wD04Pn7TuaPcZ/fH6/5mMg5/s0uRoAiI8jGUIoHDOXzdx/D:OtpGQnc4Xun/i/e1+JnqjOXPD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15dd8f04dd60b4c2d45bb486279ba8a9_JaffaCakes118

Files

15dd8f04dd60b4c2d45bb486279ba8a9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbc40d117dca1cda273d8f5a6e2c6c26

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
WriteConsoleA
GetVersion
DeleteFileA
Sleep
SetLastError
SuspendThread
GetStartupInfoA
HeapDestroy
CloseHandle
FindResourceExA
GetCommandLineW
GetModuleHandleA
ExitProcess
CreateSemaphoreW
HeapCreate
CloseHandle
lstrlenW
GetEnvironmentVariableW
OpenEventA

user32

GetKeyState
GetClassInfoA
GetWindowLongA
SetFocus
DispatchMessageA
GetSysColor
FindWindowA
DispatchMessageA
DrawTextW
IsZoomed
CreateIcon
PeekMessageA
CallWindowProcW

docprop

DllGetClassObject
DllGetClassObject
DllGetClassObject
DllGetClassObject

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 806KB - Virtual size: 806KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ