006d2388123d997e0ed5518b39197c84_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

006d2388123d997e0ed5518b39197c84_JaffaCakes118
Size

38KB
MD5

006d2388123d997e0ed5518b39197c84
SHA1

6a0445e0ae165d010961ac4078927200603a7bac
SHA256

71514dddc3bcce353787430971dbb501dd596ea6f077363a062d7d53ea977781
SHA512

268fa6ecab78f49751587e7f88df2594df9f52834691412e85f6435f85383a394ce06f44a4943ebcdab37689e800b02079b8d14df1c5be1b60274dc64e8317f1
SSDEEP

192:0ESwcHpk8CmBOaxfj+uyJoHy5x1kkxtv0Y3VX562dFex/on6FF/og+6W7:0pTpk8CUOUvyhYYlXt3eVon6FF/+b7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
006d2388123d997e0ed5518b39197c84_JaffaCakes118

Files

006d2388123d997e0ed5518b39197c84_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1cfc0535f1ff2362f1c5c3a5ed593ac7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GlobalFree
GetModuleFileNameA
GetStartupInfoA
GetModuleHandleA
Sleep
GetWindowsDirectoryA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

mfc42

msvcrt

_ftol
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
memcpy
_strnicmp
strlen
_strdup
_mbsupr
free
strcpy
strcat
_setmbcp
_EH_prolog
__CxxFrameHandler
memset
sprintf
_itoa
_mbscmp

shell32

ShellExecuteA
ShellExecuteExA

user32

wsprintfA

Sections

sjIp
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.avc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE