f366a93f570c0c85da3b00eaee76584c_JaffaCakes118 | Triage

Sharing

General

Target

f366a93f570c0c85da3b00eaee76584c_JaffaCakes118
Size

11KB
MD5

f366a93f570c0c85da3b00eaee76584c
SHA1

559f6a286086785608133c5c0ec7e6e2c30d8b56
SHA256

76e1a36d8d47d14ed1e0d116c91ff825c24842a1919336d3253d679d5af965cc
SHA512

e9b6f7100e9d796b5c8f5fa73c853def905010a78b5bd7a3f098167c571c5143692e7bf4c69e2b0d72255849f9d934d4cdcfa82e29685b011d7745c2bd4be3a4
SSDEEP

192:PZH+v+cXezw8x5xYQjxoxg/C3PnzQrTWa:R+2cXeUYTjxWgun+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f366a93f570c0c85da3b00eaee76584c_JaffaCakes118

Files

f366a93f570c0c85da3b00eaee76584c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3eb6999d1b3911e1671ef1523874f5b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeResource
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetTempFileNameA
GetTempPathA
GlobalAlloc
LoadResource
CreateMutexA
ReleaseMutex
RtlMoveMemory
RtlZeroMemory
SetFilePointer
SizeofResource
WinExec
WriteFile
lstrcatA
lstrcmpiA
lstrlenA
CreateFileA
CopyFileA
LockResource
CloseHandle

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA

advapi32

RegCreateKeyA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 916B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE