1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118 | Triage

Sharing

General

Target

1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118
Size

206KB
MD5

1ed278964455c8ac3c202ed075b51ed3
SHA1

bb69cbff24e1dda9108880a51df05ad552f3b17c
SHA256

d3b9138b620139601041e436e3879fb7b08b5f812f91a04ac03ca50636e679fb
SHA512

47631227f453bbaab29ac95e8e868224abebfc9a794390cd770f29de6e7464676dc3e9417fac6c9cdea887b745ec5d052edefe04c76c6b63274d037b543cc617
SSDEEP

3072:Igm+rjPBVfV8XOBoFAdj58j3HPO303voR7yQpEK6fXvke3y09iZe5S:Igm4NV21ydUXPO3W6yK6fsmqe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118

Files

1ed278964455c8ac3c202ed075b51ed3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1f394a6ef63d9be0bf4af5403319cd04

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_cexit
__wgetmainargs
_XcptFilter
wcsrchr
exit
__set_app_type
_adjust_fdiv
wcschr
_exit
_c_exit
fclose
_wcsicmp
wcscat
__p__commode
_wcsnicmp
fwprintf
_initterm
_controlfp
_except_handler3
__p__fmode

kernel32

GetCommandLineA
GetLastError
GetModuleHandleA
GetTempPathW
LocalFree
FormatMessageW
lstrcpynW
GetProcAddress
ExitProcess
lstrlenW
QueryPerformanceCounter
CloseHandle
UnhandledExceptionFilter
VirtualAlloc
GetSystemTimeAsFileTime
GetTickCount
GetCurrentProcess
FileTimeToSystemTime
FreeLibrary
VirtualFree
lstrcpyW

shell32

Shell_NotifyIconA

advapi32

RegQueryValueA
RegOpenKeyA
RegCloseKey

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ