25e24d5c7f913695ffc6181073e83764_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

25e24d5c7f913695ffc6181073e83764_JaffaCakes118
Size

179KB
MD5

25e24d5c7f913695ffc6181073e83764
SHA1

a91a8c883d7287b39cf9df6fbcc25c7829408ca5
SHA256

c5e34c6e466afc8423966705893068e71b18efb219214b726214e4a88216a9e3
SHA512

15593edf9f68e876425cbc5b5f081bcecb7d7baf6d0132986864ee6db1d53fe783df5cc23a68e3ad73ab5998ff84b6e8bd849cde2c7e7e819e4a6e61406d5de2
SSDEEP

3072:CEOqZnHBddFHW5NRi0Mk+IL22OQion30yw2yhyFH8M4xGLVTnfsJ//H9XZxf+RBT:CwH33HW5Pi0M9IL22OQJ342uMVnW/v9E

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25e24d5c7f913695ffc6181073e83764_JaffaCakes118

Files

25e24d5c7f913695ffc6181073e83764_JaffaCakes118
.exe windows:27365 windows x86 arch:x86

75dcc80ded6b7aabd5b62e765ce95dba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegQueryInfoKeyW
RegEnumValueW

kernel32

GetCommandLineW
GetCommandLineW
GetModuleHandleW
LoadLibraryA
VirtualAlloc
GetModuleHandleA
LocalAlloc
SetEvent
GetCurrentThreadId
GetCommandLineW
VirtualAlloc
lstrlenW

user32

SetTimer
CreateWindowExW
CreateWindowExW
UpdateLayeredWindow
GetMessageW
PostMessageW
GetDC
LoadStringW

gdi32

SelectObject
DeleteDC
BitBlt
GetObjectW
GetDeviceCaps
GetStockObject
CreateCompatibleBitmap
CreateFontIndirectW

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ