f411b19e1d37ca80c728ab04627c0fed_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f411b19e1d37ca80c728ab04627c0fed_JaffaCakes118
Size

20KB
MD5

f411b19e1d37ca80c728ab04627c0fed
SHA1

8d4a88bc1e9837f3988d75011a8c3790f3cca983
SHA256

ec51551b5108d4496ea37656c85d513fb4f641b1624868683900ad2007f1fc25
SHA512

82204530863c2216fd8bbcca7522020a63c3e2daf57aa4bf32cb2af40d6c0dd0f39ce6d94476d186b3becc82935b21a46006cce2fb6997949bd7bddd7e84ddfa
SSDEEP

192:Wz9i0COq3xRq79TzqiG3SWBJvbCodKTfl0fnH2p7I24XopU4bWt9Z+dL+J3HtXoG:TOoM5yiQpbWxT+up7IxYiD+du5N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f411b19e1d37ca80c728ab04627c0fed_JaffaCakes118

Files

f411b19e1d37ca80c728ab04627c0fed_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dde5513a71862ab68c0e4cc03883f533

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetModuleHandleA
ReadFile
SetFilePointer
GetModuleFileNameA
lstrcpyA
lstrcatA
LoadResource
lstrlenA
FreeLibrary
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
CopyFileA
GetCurrentThreadId
Sleep
GetLastError
CreateMutexA
LockResource
SizeofResource
SetFileAttributesA
CreateFileA
WriteFile
CloseHandle
GetTempPathA

user32

GetMessageA

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 838B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ