fbb6d778c54c4fbe9b33d76c2957012f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fbb6d778c54c4fbe9b33d76c2957012f_JaffaCakes118
Size

28KB
MD5

fbb6d778c54c4fbe9b33d76c2957012f
SHA1

5b12f08b4f5666ba0ce0e925a48835ce9f05f861
SHA256

71fd4f12f4cd3e41f2d9dc5d0e07d20f9a597de6e1c57a8a2e3db0ff2339409f
SHA512

27683cd4275f55ca335c121fde7a4bff19cd8507213cb79ca8417145ae1361fa4f3dd23f601eb601b05e1b87116d8e2a0927abbdeaa7497d78395e1525ecfd78
SSDEEP

768:ZFFu30/beuI8MdpSAy1zpQA7AQBBh2wohPyrw0WT:RFbeuTcfOpQ8BdohPyG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbb6d778c54c4fbe9b33d76c2957012f_JaffaCakes118

Files

fbb6d778c54c4fbe9b33d76c2957012f_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4f3862b17397a800895d2395a4dcd0cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dnsapi

DnsFree
DnsQuery_A

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
HeapFree
WaitForSingleObject
lstrlenA
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcmpA
lstrcatA
GetEnvironmentVariableA
GetComputerNameA
CreateFileA
GetFileSize
SetEvent

user32

wsprintfA

advapi32

SetNamedSecurityInfoA
RegSetValueExA
RegCloseKey
GetUserNameA
RegCreateKeyA
SetEntriesInAclA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE