edaf4610e61974192944594b72ba0829_JaffaCakes118 | Triage

Sharing

General

Target

edaf4610e61974192944594b72ba0829_JaffaCakes118
Size

22KB
MD5

edaf4610e61974192944594b72ba0829
SHA1

3dc15164c7cfd110a73209fc4419c6b1539b08ce
SHA256

91ae3bc52c0dfe634d9990e570a115eedcae0ea5b14bb150b23d27f2cef3b130
SHA512

f979d42faab1108bfe2103f7e72fd2ba7c1ba3f7fac0b4996891e3ea6307c446e15d7f620489eeabda2cfb7a5fcbf1bb0233fa59552680b573bbf06a422af9ed
SSDEEP

384:8+nuR1SZjv7nBUeohd5UAZhBv3Yg2kWrTkFy8/b0mM8bR3Tm:wrSZv7nCvhdRZhB3p2km6y8yEj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edaf4610e61974192944594b72ba0829_JaffaCakes118

Files

edaf4610e61974192944594b72ba0829_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fcd5e7c6a05aae991a712f9b7f00c5e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
FreeResource
WriteFile
CreateFileA
LockResource
LoadResource
SizeofResource
FindResourceA
CreateMutexA
CreateEventA
PulseEvent
OpenEventA
LoadLibraryA
lstrlenA
CopyFileA
GetSystemDirectoryA
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
HeapReAlloc
WideCharToMultiByte
GetCurrentProcess
GetCurrentProcessId
VirtualFreeEx
GetExitCodeThread
WaitForSingleObject
CreateRemoteThread
GetModuleFileNameA
GetModuleHandleA
lstrcmpiA
GetProcAddress
lstrcpyA

user32

wsprintfA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ