a28b528c73a2e5e06b5b535db03b9132_JaffaCakes118 | Triage

Sharing

General

Target

a28b528c73a2e5e06b5b535db03b9132_JaffaCakes118
Size

142KB
MD5

a28b528c73a2e5e06b5b535db03b9132
SHA1

6b54ee539c8aacdb7b9cd5f6656977019e4c834e
SHA256

c57f93ef59e128b92725fa21ea639eef5762db792fd5d9f408a439de976f7573
SHA512

485e1ad7ac5781a36ade8e6c233d76c97c723790a3a9c7c817b307023a77d05f295e9933ad9a6da3ef309f4c93acb04102ea2013f62d24c1a33f5fca395a09d4
SSDEEP

3072:9N4+69jpWSbgg8LFBAXmlwpqUFCYKwi5s/b:/47jFEgYnA7D1iM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a28b528c73a2e5e06b5b535db03b9132_JaffaCakes118

Files

a28b528c73a2e5e06b5b535db03b9132_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e9aa776e6d1ea38dfabc8acd4c99d804

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_except_handler3

kernel32

CreateThread
lstrcatA
lstrcmpA
GetLastError
CreateMutexA
lstrcpyA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetCommandLineA
WriteProcessMemory
lstrlenW
WaitForSingleObject
Sleep
ReadProcessMemory
GetModuleHandleA
GetCurrentProcess
IsDebuggerPresent
lstrcmpiA
CloseHandle
HeapFree
GetEnvironmentVariableA
HeapAlloc
GetStartupInfoA
GetProcessHeap
ExitProcess
lstrlenA
GetModuleFileNameW

user32

GetWindowLongA
MessageBoxW
MessageBoxA
GetSubMenu
CallWindowProcA
SetFocus

gdi32

SelectPalette
CreateCompatibleDC
CreateDIBitmap
CreateDCA

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ