03cbddd23a45771c34f5a1f96e20d01a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

03cbddd23a45771c34f5a1f96e20d01a_JaffaCakes118
Size

121KB
MD5

03cbddd23a45771c34f5a1f96e20d01a
SHA1

6a84ef7d9650d25e9536337ad42d942132a861cc
SHA256

558f5e253898e92715f5870a4dc1508ae572e6ad288b6ec8e73dfc9543915374
SHA512

40d63d6ec23381f21e34072419e1dc990edb2716fc1e390dc568e949890e1eda91e047da8b04637cde8206c95ec0dda0e379134e96eeb1eb6c5432045ac441dc
SSDEEP

3072:SgygjVeYBCwqDxkJZ2OPRqHTOIICSekmYacBhxSX+iK99kgC:SgyIDISP8HT8ekmYxvxU+iw9k3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03cbddd23a45771c34f5a1f96e20d01a_JaffaCakes118

Files

03cbddd23a45771c34f5a1f96e20d01a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9e3719a5c293722cc7735af9eb77d510

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
FindNextFileA
FindResourceA
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempPathA
GetVersion
LoadResource
ExitProcess
OpenProcess
Process32First
Process32Next
SetCurrentDirectoryA
SizeofResource
Sleep
VirtualAllocEx
WriteFile
lstrcmpiA
lstrlenA
DeleteFileA
CreateToolhelp32Snapshot
CreateRemoteThread
CreateProcessA
CreateFileA
LockResource
CloseHandle

user32

wsprintfA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryValueExA
RegSetValueExA
RegOpenKeyExA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ