003c727e0379c5d9ae62e458b7a8b501_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

003c727e0379c5d9ae62e458b7a8b501_JaffaCakes118
Size

8KB
MD5

003c727e0379c5d9ae62e458b7a8b501
SHA1

590597a8ed495c23f5a734fed50cae20ca85a62b
SHA256

a07f258cfb9e881308d5790552fd2129c1bed6ea44023efe35b8dbc2f6b3c535
SHA512

ebefa272bb3c804e02ab0f88b6ac138b2e7889f53b0ac281a7e2afa8bb4dc02c511afbb93f608680d30658aa27f758c459b86da7e93cf77fdaccde75c407a1f8
SSDEEP

192:SLwuwsGjnpno1SYYStPBAgmsDpQM9oLBO5Yc:YVGbpo1SYYs6M6O5Yc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
003c727e0379c5d9ae62e458b7a8b501_JaffaCakes118

Files

003c727e0379c5d9ae62e458b7a8b501_JaffaCakes118
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE