00ab0b31b5eee1c7aa2e9797260f10b9_JaffaCakes118 | Triage

Sharing

General

Target

00ab0b31b5eee1c7aa2e9797260f10b9_JaffaCakes118
Size

406KB
MD5

00ab0b31b5eee1c7aa2e9797260f10b9
SHA1

347eaaabaf4f345b77f50bc703aa5e546a94b276
SHA256

41e983e4787012c2af5ad28382c1faebba620c21fb33b3d86d869a55d4da7408
SHA512

2c47c1a1caf08343f07a24c21b8a5e1a84ea0665a402826b2c5720d953080061ecd9afdcf7482087bfd7bb1b93fd34a9e0de0f9503fdf7be6e9a72e9cd6e9247
SSDEEP

12288:aPR/JZAPHQcn6lQyvCDveoCov6nN7+ozh:aJRZAPwHaeCDveoChNCo1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00ab0b31b5eee1c7aa2e9797260f10b9_JaffaCakes118

Files

00ab0b31b5eee1c7aa2e9797260f10b9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d4ff4e9520d2b9d618be12fecec0c0ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
LoadResource
SizeofResource
FindResourceA
CloseHandle
WriteFile
CreateFileA
GetTempFileNameA
DeleteFileA
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetStartupInfoA
LockResource
lstrcpyA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetModuleFileNameA

lz32

LZCopy
LZOpenFileA
LZClose

user32

MessageBoxA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 397KB - Virtual size: 397KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ