30e4eb501940727a589dcbe8b2fed8e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30e4eb501940727a589dcbe8b2fed8e4_JaffaCakes118
Size

146KB
MD5

30e4eb501940727a589dcbe8b2fed8e4
SHA1

352be6c2d4186b9df51125404f6d173bde7a6573
SHA256

123f425e93131508e0c8e6ec5061999afbff0e13e6390c99e3b0f685e054a802
SHA512

233976841a4290e634ebd96f9bb7a67002e80168fbbabc79a81184c465530217e9c97092bf94f1741746173e70abfbee6c2e754225f458d8d31369c36b3a25a7
SSDEEP

3072:fb5Bk4nDu2Y46E05ZP58DC+N2MsghJvHYG1PQCD+bRWKvtot5A:Ts4y2F0DPuG+FRhpHToYqu4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30e4eb501940727a589dcbe8b2fed8e4_JaffaCakes118

Files

30e4eb501940727a589dcbe8b2fed8e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a7248259a6f54acb10549e7e368288ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStdHandle
GetCurrentProcess
ReadFile
CloseHandle
WaitForSingleObject
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
VirtualProtect
LocalFree
ExitProcess
GetCurrentThread
VirtualAlloc
SetEvent
GetVersionExA
LocalAlloc
ResetEvent
GetCurrentProcessId
CreateEventA

user32

GetActiveWindow

msvcrt

memset
wcslen
wcsncpy
memcpy

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 14B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ