f298d72be166a51e25961f0da7a76402_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f298d72be166a51e25961f0da7a76402_JaffaCakes118
Size

128KB
MD5

f298d72be166a51e25961f0da7a76402
SHA1

7124800382efaf3f2f270315cced5a5e0918392d
SHA256

7881162fd7bf9b436f83fa22aff5b50b720efbbfe01132506d9f776e1e483b5c
SHA512

ddd89443cfbda95acb827a4049cc6d4554b365512eb0cd7e8c43c705a74b99ec90be932904d43089626ec7085f3858c7f2f82c130b13d7759122f7fe3222c2dc
SSDEEP

3072:K0mwoy3bo0fn1B2fUs5/u90L5maW9Tk3bo0fn1B2fUs:KLy3nnPqUsUspW9Tk3nnPqUs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f298d72be166a51e25961f0da7a76402_JaffaCakes118

Files

f298d72be166a51e25961f0da7a76402_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9c0050334da711b5147027326c52827d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetFileSize
GetModuleHandleA
CloseHandle
GetTickCount
GetWindowsDirectoryA
CopyFileA
LocalAlloc
LocalFree
CreateFileA
ReadFile
RtlUnwind
WinExec
WriteFile
DeleteFileA

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

crtdll

__GetMainArgs
exit
memcpy
memset
printf
raise
signal
strcat
strchr
strlen
strncpy

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ieoo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ