f1c806a8fb76030f718ae4ae2dfae50c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f1c806a8fb76030f718ae4ae2dfae50c_JaffaCakes118
Size

17KB
MD5

f1c806a8fb76030f718ae4ae2dfae50c
SHA1

3d8e9d25c04006802d44d3a7f8197bfa1bab00bb
SHA256

00e3e3aa9d3344f5f772ddeea1506002666074f99efacf9b1f62bc349fa323a4
SHA512

4ff6cca64c2c17070f4b304ef4e15edb9ae56ae13218767df12ff955315f9a7209a78df9a71f7b25c1a07b16eec6bcf2bd995b118b1ff280d0d450d11ac41682
SSDEEP

384:KOqv3F2Arv8DMfuW06xWL3diEE9FQhLv6:KpvCDVW9xWzdiEE9FQhLv6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f1c806a8fb76030f718ae4ae2dfae50c_JaffaCakes118

Files

f1c806a8fb76030f718ae4ae2dfae50c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

406de7aa000a6030b668caed148bfc5d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SendMessageA
FindWindowA
wsprintfA

kernel32

CloseHandle
CreateFileA
CreateThread
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
GetLogicalDrives
GetModuleFileNameA
GetModuleHandleA
GetProcessHeap
GetTempPathA
GetTickCount
HeapAlloc
LoadResource
LockResource
RtlZeroMemory
SizeofResource
Sleep
WriteFile
lstrcatA
lstrcpyA
lstrlenA
HeapFree

shell32

ShellExecuteA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA

shlwapi

StrStrA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 982B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ