048250b97a9104c4e5f294b0cf600d94_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

048250b97a9104c4e5f294b0cf600d94_JaffaCakes118
Size

116KB
MD5

048250b97a9104c4e5f294b0cf600d94
SHA1

22af9817f1a3a716d6fa886cf0e280d7ecc8704e
SHA256

0aa442adc53bf78bcbb1a9110ca74777eb7fed434e37f98945848a9d1f0279b9
SHA512

24e68d6da49265f8eb5a78615bdc6c159ba984da59dce30a7f5bb5e8685196de3b3a1e3bab528450ccffaf0eb9df9c4ff799e7f8ad81096f580db6ed0582092a
SSDEEP

1536:QV4MZ7Zo/2faH/JamvFPNY9CafVDMzixXoGTPuhrfOkBQ7D33HamvFPNY9CafVDo:Q982fO/3NYQYAziTjuhrf0HVNYQYAzi4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
048250b97a9104c4e5f294b0cf600d94_JaffaCakes118

Files

048250b97a9104c4e5f294b0cf600d94_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9c0050334da711b5147027326c52827d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetFileSize
GetModuleHandleA
CloseHandle
GetTickCount
GetWindowsDirectoryA
CopyFileA
LocalAlloc
LocalFree
CreateFileA
ReadFile
RtlUnwind
WinExec
WriteFile
DeleteFileA

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

crtdll

__GetMainArgs
exit
memcpy
memset
printf
raise
signal
strcat
strchr
strlen
strncpy

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ieoo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ