f65ba9db7834e43858661af05e6e6d02_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f65ba9db7834e43858661af05e6e6d02_JaffaCakes118
Size

18KB
MD5

f65ba9db7834e43858661af05e6e6d02
SHA1

1bf5e14b7f88b193e47b4487d842dfcfca10e653
SHA256

0bdaa6cfc65766a251a92213a8481bb157dc4f74f391a24059e44e3a02a1f9b4
SHA512

a0edf8e952c0bef861e3ef94c9dd7b0e47bebde11161f08c7a87646ae72d9e5188e77ee8a8d2e986375768b92dcd4e4e44d7097536372aaf20e2649612b784ec
SSDEEP

384:DKfvs0rcpYVNKMKIVkHcfiEDK8e6lXEX2TtW3k:DKfULSKI+cfiEm81lXEO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f65ba9db7834e43858661af05e6e6d02_JaffaCakes118

Files

f65ba9db7834e43858661af05e6e6d02_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3ce3ea7aac6cdd2e3b5f95a9b3d214f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
CloseHandle
lstrcatA
WaitForSingleObject
DeleteFileA
CreateEventA
WriteFile
SetFilePointer
CreateFileA
lstrlenA
GetModuleFileNameA
LoadLibraryA
FreeLibrary
RtlUnwind
HeapReAlloc
lstrcpyA
GetModuleHandleA
GetProcAddress
GetTempPathA
GetFileAttributesA
ExitProcess
SetEvent
CreateThread
GetVersionExA
ReadFile
ExitThread
HeapFree
lstrcmpA
ResetEvent

user32

DestroyWindow
MsgWaitForMultipleObjects
DispatchMessageA
PeekMessageA
CreateWindowExA
CharToOemA
wsprintfA
TranslateMessage

advapi32

RegOpenKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey

shell32

SHGetFolderPathA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ