168281a81e844908f561d77016e133d2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

168281a81e844908f561d77016e133d2_JaffaCakes118
Size

144KB
MD5

168281a81e844908f561d77016e133d2
SHA1

d9b7ba82fe4aa45b014b445031a45891b93e13a8
SHA256

464be7b9e84380c519c8057773539ca29d845e6afb54db66a277edac3baef02a
SHA512

9ad234055e78ab8a15b84de392c2483d3079a04c4f1868b3e4b87780d79d033663811e816f4697a12feb9bf30b41666559cb1842d34e3697e1ce47490e9b5bb4
SSDEEP

3072:NRn6GPa7aXwQNfRjrVOEf7Y4Qpyok9WUZxiv7Q:N56Gfr9tMEfp9RZov7Q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
168281a81e844908f561d77016e133d2_JaffaCakes118

Files

168281a81e844908f561d77016e133d2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec5d697360306ce025888e1386f14089

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentThread
GetComputerNameA
CreateMutexA
GetVersionExA
GetProcAddress
LoadLibraryA
GetCurrentDirectoryA
VirtualProtect
LockResource
LoadResource
GetCurrentProcessId
GetWindowsDirectoryA
LocalFree
GetCurrentProcess
ExitProcess
GetSystemDirectoryA
VirtualAlloc
GetCurrentThreadId
LocalAlloc
CreateEventA
FindResourceA
GetStdHandle

advapi32

GetUserNameA

user32

GetForegroundWindow
GetActiveWindow
GetSystemMetrics

msvcrt

memcpy
memset
wcslen
wcsncpy

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ