5525609c75c35325bb0160f8611e0b48_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5525609c75c35325bb0160f8611e0b48_JaffaCakes118
Size

38KB
MD5

5525609c75c35325bb0160f8611e0b48
SHA1

870ca0f3adc332e1abc5543743b9a41cd5737751
SHA256

19b6484a551aa8a07eb1179067156ae368d92d860a60a9be6a48b30b14e4d766
SHA512

a6c8ddaeaafcba66c962cffbdf8c851a0b0dea4ce2777fa7cf14ef9054a6901642aed0ba5ae4d323a5132c71bf1ae5de96a3507b27e2572e5d0dd72963ade9fb
SSDEEP

768:LID/7y/KJ3bvKkDg7zfNID1NzUBuwKlVxv8WocU7t:L8/7y/QLvKkKriD1CuwIOcI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5525609c75c35325bb0160f8611e0b48_JaffaCakes118

Files

5525609c75c35325bb0160f8611e0b48_JaffaCakes118
.exe windows:4 windows x86 arch:x86

01750737a06ed044b958567ff0604311

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetCurrentProcess
OpenSemaphoreA
VirtualProtectEx
ExitProcess

user32

DestroyCaret
GetActiveWindow
GetWindowLongW

ntdll

NtReadFile

Exports

Exports

ReadSueikxg
Dqetfcmt

Sections

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pnhsck
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lxchiq
Size: 30KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ