02e7633bf98c11b79cebfa271aae1a94_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

02e7633bf98c11b79cebfa271aae1a94_JaffaCakes118
Size

28KB
MD5

02e7633bf98c11b79cebfa271aae1a94
SHA1

cd38f524f4e0e681294646767e46ebdbdbaff21a
SHA256

179ced0c1bd2f335d95a099628f1699a86373b9556037787f23bc4f782adbf19
SHA512

4ad2ac7f239d0cf95e5a180fb9457596357c0d3236ee79e5797bf9c9e88c765d9e18c22ae8dd93b3fb0e94cbd91260be65410f0603963de09241aaeed1424568
SSDEEP

384:zb0WAZFTQI4Wc1SUW61DLUYkAbEWpdU7Kp1WfKiojP/H2RFE5MXFPOMjULCbQKuN:HgFISA1D3vp1qUjP/H2RFLPxU+btc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
02e7633bf98c11b79cebfa271aae1a94_JaffaCakes118

Files

02e7633bf98c11b79cebfa271aae1a94_JaffaCakes118
.exe windows:5 windows x86 arch:x86

00e24b270f04dc51172be33fdeca02d7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

msoobe.pdb

Imports

advapi32

RegOpenKeyExW
RegSetValueExW

kernel32

ExitProcess
GetLastError
FreeLibrary
GetCommandLineW
GetProcAddress
LoadLibraryW
WritePrivateProfileStringW
ExpandEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

wsprintfW

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE