0b5449ff8feb7322900072ef196b06c6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0b5449ff8feb7322900072ef196b06c6_JaffaCakes118
Size

1KB
MD5

0b5449ff8feb7322900072ef196b06c6
SHA1

72c32a403755ce06bb1d13e087b02f079bf2eaaa
SHA256

d8c26e77192f0ed73f6d20ecf2b804da29df18bf2049bea81e1f4f8b2cd7fba3
SHA512

156803b1f2e497f14aba0036252f220c26a0bbe52bc192e72dd7ce3f3a4feef5fbede72e94e6914a6ade06c308c1efcc93127ccd244395ca296264c7781262a1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/wikiworm.exe

Files

0b5449ff8feb7322900072ef196b06c6_JaffaCakes118
.rar
wikiworm.exe
.exe .js windows:1 windows x86 arch:x86 polyglot

ea8a76f6edad1ff842691f45567a5899

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CloseHandle
CreateFileA
CreateFileMappingA
CreateProcessA
GetCurrentDirectoryA
GetFileSize
MapViewOfFile
Sleep
UnmapViewOfFile
VirtualAlloc
WriteFile

user32

MessageBoxA

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

urlmon

URLDownloadToFileA

Sections

.data
Size: 1024B - Virtual size: 549B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE