573d73b849a7ecb6b74fdf6603581a0d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

573d73b849a7ecb6b74fdf6603581a0d_JaffaCakes118
Size

5KB
MD5

573d73b849a7ecb6b74fdf6603581a0d
SHA1

33f81a4909d79ea499b66d43084888550eeb12ca
SHA256

c986643c2f36467eb8123cacf9ca293e50eefb71de73486a109da1114ce02db9
SHA512

386c986fabe0e7c6bfd3c9b1b16cff3558880e18c2bd730b7b8e2deb8972a926194b0ca9231452d3a1bddbc22c741a93e98d5e9d565e821d53124791e8e54e68
SSDEEP

48:K4NUkA6aDBMBzVEfTPJGNmo6JNJ30ml1WiIZJvMv/fyYIHhBE1Lzmi:jPaiNibIchJNJ3PlM3BMnfzIB6xmi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
573d73b849a7ecb6b74fdf6603581a0d_JaffaCakes118

Files

573d73b849a7ecb6b74fdf6603581a0d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0776fcd6748ba57f85ab5ab2fc6ae90f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
lstrcpyA
WideCharToMultiByte
CreateEventA
CreateToolhelp32Snapshot
Process32First
CompareStringA
WaitForSingleObject
CloseHandle
GetModuleFileNameW
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
ExitProcess
GetModuleHandleA
SetEvent
CreateThread
GetProcAddress
ExitThread

user32

EndPaint
BeginPaint
DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE