f7381f953f2cee1faa3270d288c0706d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f7381f953f2cee1faa3270d288c0706d_JaffaCakes118
Size

955KB
MD5

f7381f953f2cee1faa3270d288c0706d
SHA1

674a0e8aa5fe974560327084aafcbc34bdc7ab6a
SHA256

e467abbe471877bb4848cf11acdff1bc565fd80bf3fa296d3cf154575e5656b8
SHA512

bd472c4ee0093255d2115f78975f8ec5ff3687f6426caa244bd71791e241ce6e27d3e990ed6489c313923b707eadedddf30ae201547697b0536107c05672b930
SSDEEP

24576:VLzlcB/LYMNoxEOSvgyBrn1T/I4C8m2Ek0skZC:RzoLhN0EOSpTpm7lTZC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7381f953f2cee1faa3270d288c0706d_JaffaCakes118

Files

f7381f953f2cee1faa3270d288c0706d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c13c72fa1e908e738853535529fd4b78

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mini_installer_full.pdb

Imports

shell32

CommandLineToArgvW

shlwapi

StrStrW

kernel32

lstrcmpiW
GetCommandLineW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
DeleteFileW
GetLastError
EnumResourceNamesW
LocalFree
lstrlenW
GetModuleFileNameW
RemoveDirectoryW
CreateDirectoryW
GetLongPathNameW
GetTempFileNameW
GetTempPathW
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
WriteFile
CreateFileW
LockResource
LoadResource
lstrcatW

advapi32

RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23.3MB - Virtual size: 23.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ