fcb4661543cd8156f4468c6e26308e53_JaffaCakes118 | Triage

Sharing

General

Target

fcb4661543cd8156f4468c6e26308e53_JaffaCakes118
Size

45KB
MD5

fcb4661543cd8156f4468c6e26308e53
SHA1

f5a493e88202a097b2a03ffb75a9a4ecd0155e43
SHA256

bdc017b4299e63bef790d5c349038cba3c7d49b99203eaa93df028ea0209a6a2
SHA512

9289ba25296f6df0019320a5e0c59339f411a1f73c3d2e2e142c3a377b75603273fdc49a3697fedbc4b2548b4dba5f791c93e8b3bb93c577b7152f5a0f5fcc16
SSDEEP

768:HLs9+wd518Dyq+6KZNVXB+WaiJlGZUdFmvPkN7R13b3XnDvr3zvDfXuUV707IkeH:w9+wdX8Dy16KZNVXB+WaiJKkF9N7R13N

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcb4661543cd8156f4468c6e26308e53_JaffaCakes118

Files

fcb4661543cd8156f4468c6e26308e53_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6b32ea6b391a869b8ebe82a9cf4374c8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemDirectoryA
GetTempPathA
GetVersionExA
HeapAlloc
HeapFree
LoadResource
CreateRemoteThread
OpenProcess
SizeofResource
Sleep
VirtualAllocEx
VirtualFreeEx
WaitForSingleObject
WinExec
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpiA
lstrcpyA
lstrlenA
CreateFileA
CopyFileA
LockResource
CloseHandle

shell32

ShellExecuteA

advapi32

RegOpenKeyA
RegSetValueExA
RegCloseKey

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE