e7dff2582e34e5d05965142245c6b23c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e7dff2582e34e5d05965142245c6b23c_JaffaCakes118
Size

128KB
MD5

e7dff2582e34e5d05965142245c6b23c
SHA1

618c1889a390d177536d5d98294970be6af8ad35
SHA256

118d2b9fd9837e72a3e8877112bf4b6fafe8debb6b40382d419c7a78ddca840c
SHA512

0c3a974ee3af6e4e17d9ed71a8622cdcee5905cff04028558259ebf6bdf30ce516df8eb2e3f55faccb465152285416f4d268c2060bd2bb62c3aa95bcf48eaa0d
SSDEEP

3072:xGQ8mDP+NimZGbnfHGjVjTSiHDP+NimZGbn:Km+fZGbn/+XSiT+fZGbn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7dff2582e34e5d05965142245c6b23c_JaffaCakes118

Files

e7dff2582e34e5d05965142245c6b23c_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9c0050334da711b5147027326c52827d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetFileSize
GetModuleHandleA
CloseHandle
GetTickCount
GetWindowsDirectoryA
CopyFileA
LocalAlloc
LocalFree
CreateFileA
ReadFile
RtlUnwind
WinExec
WriteFile
DeleteFileA

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

crtdll

__GetMainArgs
exit
memcpy
memset
printf
raise
signal
strcat
strchr
strlen
strncpy

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ieoo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ