291d0b0ab22a50742743eecdf6a365df_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

291d0b0ab22a50742743eecdf6a365df_JaffaCakes118
Size

436KB
MD5

291d0b0ab22a50742743eecdf6a365df
SHA1

32532d917bf53035d3a8939eec5cb24382d34faa
SHA256

e544180d0bec16a8776f3d4faad4a3a0181749e14ed7eb92416badda8b9d9a9c
SHA512

d9095b48e5f7183a50e0d85d5420f706ecbe590224865938bcd6c88f452d7e5c18bdf0fd44084d4965abbff185abdaf8b6373ca31e389aed74a0fccc5caabc87
SSDEEP

3072:9GFZppDfea3KJCzNTV0Zf74av9/e4J9oD2n1hgjb7Yi9KxlT1BTX:QFZppLe0KJCBTV2dexKhblT15X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
291d0b0ab22a50742743eecdf6a365df_JaffaCakes118

Files

291d0b0ab22a50742743eecdf6a365df_JaffaCakes118
.exe windows:5 windows x86 arch:x86

240890a13eaae031279b53a7c8064a56

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathCombineA
PathAddExtensionA

kernel32

LoadLibraryA
VirtualProtect
CreateFileA
ExitProcess
GetProcAddress
VirtualFree
VirtualAlloc

user32

GetMessageA
GetForegroundWindow
TranslateMessage
DialogBoxParamA

Sections

.text
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 428KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ