36d79eea45b28a89ab697b26f29394f3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36d79eea45b28a89ab697b26f29394f3_JaffaCakes118
Size

14KB
MD5

36d79eea45b28a89ab697b26f29394f3
SHA1

715b878167d7921cac133fa88ae72f8456c97445
SHA256

64515e399a842f703a39642a309160fa0b3b0ff86b87d0526983f25abd4d59c7
SHA512

c00ce1a6358acf15927d00168fc14e0065ce9a2fbe6ecebd771e0105eeea46ab1e577094090a1eabd577ecf117b2d32fbfbb1cd7559c4328232b1f258e7eb912
SSDEEP

384:3l6tR5JmTxk/wxYoD5mMhYSkgQBjhra/JebKr:1WoD5mmGgQB6YKr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36d79eea45b28a89ab697b26f29394f3_JaffaCakes118

Files

36d79eea45b28a89ab697b26f29394f3_JaffaCakes118
.exe windows:1 windows x86 arch:x86

b940cadb80c6ab17c0d6c9725b30af77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FormatMessageA
GetLastError
SetLastError
VirtualAlloc
CloseHandle
MapViewOfFile
CreateFileMappingA
VirtualFree
GetProcAddress
VirtualProtect
LoadLibraryA
GetModuleHandleA
GetModuleFileNameW
UnmapViewOfFile
HeapFree
lstrcpynW
GetFullPathNameW
SetEnvironmentVariableW
HeapAlloc
GetProcessHeap
GetFileSize
ReadFile
SetFilePointer
CreateFileW
WideCharToMultiByte
Sleep
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW

user32

MessageBoxA

Sections

.text
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 4KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE