3688dfd00342c5ff1fffb25ce2c973eb_JaffaCakes118 | Triage

Sharing

General

Target

3688dfd00342c5ff1fffb25ce2c973eb_JaffaCakes118
Size

30KB
MD5

3688dfd00342c5ff1fffb25ce2c973eb
SHA1

9faaa0a7afb7419ac0d4ec4018e4481b8ec7ccb7
SHA256

01d49c3a9188a644567b104a3426f5c4ba0e728d83679a696e6ba6ad6d0e9c4f
SHA512

dd2d25e5ef02e9688ec4f5fa2367eadead2a6ff3e038ca7ba7ca5cf40474dc31d4e8fd38de6deb930fe1feeb98e85aa446385b5cf7237f15dfc99923ad01e347
SSDEEP

768:wkEEnhar2MAGkXRB1T6NCSNkawhqC+emvYfSNl/wDs1RUSoSe:5aCMdkXRL9SNklAFeGYfSDI+RUOe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3688dfd00342c5ff1fffb25ce2c973eb_JaffaCakes118

Files

3688dfd00342c5ff1fffb25ce2c973eb_JaffaCakes118
.exe windows:4 windows x86 arch:x86

328b3d17562f30befbc40d0c916f1a1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CopyIcon
RealChildWindowFromPoint
CharUpperA
ChildWindowFromPointEx
SetMessageQueue
SwitchToThisWindow

kernel32

GetLastError
VirtualProtect
CreateDirectoryExA
BaseProcessInitPostImport
SetConsoleCP
CopyLZFile
CreateProcessA

gdi32

DdEntry52
FillRgn
Polygon
CreateRectRgnIndirect
DdEntry5

Sections

.text
Size: 4KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE