5b27f5d52a806e359b3a651803074266_JaffaCakes118 | Triage

Sharing

General

Target

5b27f5d52a806e359b3a651803074266_JaffaCakes118
Size

320KB
MD5

5b27f5d52a806e359b3a651803074266
SHA1

915ae0bd1d5681cd5880d3b6eb1a5392b4b465ec
SHA256

6a63c53d68d24accf35f17a53de6fb926f5fd027982afd53e8477860533abc60
SHA512

b771c6e1cc96c1091204a10119bde7f28a885918a61efd211e32394909bb477d6e6d33b925baf8e78d5dc16c44260b2ad47d8e4002c64710e8d922b17b5a7468
SSDEEP

6144:qWkHk7Gknm0qSDlhHFj6SWC1e3jKb9wWF/QYD5A:8E77m0DhpFOSWlWnFrDe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5b27f5d52a806e359b3a651803074266_JaffaCakes118

Files

5b27f5d52a806e359b3a651803074266_JaffaCakes118
.exe windows:4 windows x86 arch:x86

64754fd033e552af10696090de9a236e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
LockResource
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
LoadResource
GetProcAddress

user32

BeginPaint

advapi32

RegCloseKey
RegCreateKeyExW

msvcrt

_adjust_fdiv
rand
srand
_exit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_XcptFilter
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 774B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 315KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ