37243027b1e6e4ad04ab8079d1938988_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

37243027b1e6e4ad04ab8079d1938988_JaffaCakes118
Size

61KB
MD5

37243027b1e6e4ad04ab8079d1938988
SHA1

7ac612b3e1e74c2c5b8e5a2016e9ddc5f79d4afa
SHA256

1de27780c14f62577ad061931690d9891634475ff86e9b6dab5793bb09489436
SHA512

6d26df0063378aac10a335775115bb42c9447b88b99ee24b96e1a35c4e6451716ee03fe93151f4be4c82b3e53d1ed27777d8cc7e4f3cca08859ba983de0a9e32
SSDEEP

768:L0pdAZr3jV1cmiXAtMSIKIWjRWIVqIxT67IaPhmdYShBqwSpN+lqdyyAqOcQta62:UizjVzQAW5KRnVqQTZvb2THDAqXua

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37243027b1e6e4ad04ab8079d1938988_JaffaCakes118

Files

37243027b1e6e4ad04ab8079d1938988_JaffaCakes118
.exe windows:5 windows x86 arch:x86

d830a63eadd38e1572722534821e9799

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
ReadFile
GetConsoleAliasesLengthA
VirtualProtectEx
ExitProcess

user32

GetTopWindow
MessageBoxA
SendMessageA

Sections

CODE
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.krphhq
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bunrhq
Size: 53KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ