f915d80a1902ba44cf2f645fb8bbd5d1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f915d80a1902ba44cf2f645fb8bbd5d1_JaffaCakes118
Size

64KB
MD5

f915d80a1902ba44cf2f645fb8bbd5d1
SHA1

234a646a8b52ed1725166486344cb5683a6a98bd
SHA256

80250605d9b88983edeefe2faeb0ca83a1bb28d14d9519e15a574a940e593ba5
SHA512

bc2d1f07aac9817a64741722eb4046bac3697b7c80768735d468940573f119f1eb760b53ce441381868fa8ac93e4a9a49e6c8f6259df027235f89cd7e579ba84
SSDEEP

1536:XZd3Pv/zU8xu/y/Q/m1FY//uvx0Ctznu:DPRxu/MQVstxnu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f915d80a1902ba44cf2f645fb8bbd5d1_JaffaCakes118

Files

f915d80a1902ba44cf2f645fb8bbd5d1_JaffaCakes118
.exe windows:1 windows x86 arch:x86

9c0050334da711b5147027326c52827d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
GetFileSize
GetModuleHandleA
CloseHandle
GetTickCount
GetWindowsDirectoryA
CopyFileA
LocalAlloc
LocalFree
CreateFileA
ReadFile
RtlUnwind
WinExec
WriteFile
DeleteFileA

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyA
RegSetValueExA

crtdll

__GetMainArgs
exit
memcpy
memset
printf
raise
signal
strcat
strchr
strlen
strncpy

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ieoo
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ