4678682dc1fd08d4bef0b10c4d27d4a0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4678682dc1fd08d4bef0b10c4d27d4a0_JaffaCakes118
Size

1014KB
MD5

4678682dc1fd08d4bef0b10c4d27d4a0
SHA1

e8a97a1df48c9f192c5f33d5a9d4705f0d8ebf31
SHA256

ce6337e173a89022018942521b408f819ef53c214cac5dbb6c90442dfec68b82
SHA512

7c7795a81325ce5d6fbf49fe0ce2171bc759661afffceea6a04a04620e30aaa906469dc21ca2e4f746ce378d09685b323e3c67ee8167169233ab23859da82637
SSDEEP

24576:NI/n7iYfhLE0XdJzisNKVdXpAj3KuwhUidTBgAu:O/2YfhLE0XXZmdZAj3FwW8u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4678682dc1fd08d4bef0b10c4d27d4a0_JaffaCakes118

Files

4678682dc1fd08d4bef0b10c4d27d4a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4280609cd785f968c7225e8d63372ed0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteExW

msimg32

AlphaBlend

user32

ToUnicode
PeekMessageA
GetClassNameA
DispatchMessageA
GetWindowTextA
OpenWindowStationA

kernel32

GetProcAddress
VirtualProtect
GetFileAttributesW
lstrcmpiW
GetModuleHandleA
CopyFileW
GetUserDefaultUILanguage
lstrcatA
lstrcpynW
VirtualAlloc

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

comctl32

_TrackMouseEvent

shlwapi

SHDeleteKeyW
SHDeleteValueW

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE