048b9a278cd548b93c10a65c5d268d48_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

048b9a278cd548b93c10a65c5d268d48_JaffaCakes118
Size

7KB
MD5

048b9a278cd548b93c10a65c5d268d48
SHA1

9a192800c19bdf83d981849c554b06021f904f9a
SHA256

939d1343c6027f81a9ef2d05e2f60ddf315203adf49d741e9d86d52bdfa23cd6
SHA512

a143ce9c8541b97459148075f45a797e1ec926d42b602e7e31c3ff8945092948122488c636b609fa357676059bf97ae0169031a45e4e51e31835dcf335ec73a7
SSDEEP

192:XMg/2Yzl4HkPEk2VwX4naJkJ+wLoBW7le:vuQGkv2VpaJkv2W7l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
048b9a278cd548b93c10a65c5d268d48_JaffaCakes118

Files

048b9a278cd548b93c10a65c5d268d48_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b0359257853ecb4c9fbd38a625715066

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetDriveTypeA
WinExec
GetCurrentThreadId
GetTickCount
GetTempPathA
CreateThread
lstrcpyA
GetPrivateProfileStringA
CopyFileA
DeleteFileA
lstrcatA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
VirtualProtectEx
GetCurrentProcess
GetLastError
CreateMutexA
GetCommandLineA
LoadLibraryA
GetProcAddress
Sleep
GetVolumeInformationA
CreateDirectoryA
lstrlenA

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA

msvcrt

fopen
sprintf
malloc
strstr
_strlwr
fclose

Sections

.data
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE