40cf57ba5e6b75cb38b94e870b7c6778_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40cf57ba5e6b75cb38b94e870b7c6778_JaffaCakes118
Size

208KB
MD5

40cf57ba5e6b75cb38b94e870b7c6778
SHA1

4c1194f42092b7f40559f9cf850d79d9e6c3f8ca
SHA256

f35afdc28a201ce0272d27f34cf2704296d585628d7b3491a217546a0a141654
SHA512

5a9b94204b319fe950e9aaf14b162664567380fc939a78e5729ef8d4e5d895aa16d39cc46d11120cd7fe0cb1d017feaf3bd9da3408da9286955e757ff0bbe6d4
SSDEEP

3072:jCD4JXDxXV6ADcywzM++7UoumDSEhxYWdnhLf7IAu1jjKoJ:GU96+7PgChLfSGo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40cf57ba5e6b75cb38b94e870b7c6778_JaffaCakes118

Files

40cf57ba5e6b75cb38b94e870b7c6778_JaffaCakes118
.exe windows:4 windows x86 arch:x86

79989bac978b2fed9ed22e2fd27115d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharNextA
AdjustWindowRectEx
CharNextW
BeginPaint
CallWindowProcA
CharUpperBuffA
CharLowerA
CharToOemA
CallNextHookEx
CharLowerBuffA

kernel32

IsBadReadPtr
lstrlenA
GetACP
GetModuleHandleA
LoadLibraryExA
LoadLibraryA
GetProcAddress
VirtualAllocEx
ExitThread
GetCommandLineA
ExitProcess
GetModuleHandleW
GetLastError
lstrlenW

oleaut32

VariantChangeType
SysAllocStringLen
GetErrorInfo
SafeArrayCreate

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ