04f346e9dd09526a3d547d804716cae5_JaffaCakes118 | Triage

Sharing

General

Target

04f346e9dd09526a3d547d804716cae5_JaffaCakes118
Size

1.1MB
MD5

04f346e9dd09526a3d547d804716cae5
SHA1

c1f289d70ec722a0249b197932892aadd1d56da9
SHA256

414837d1e48608faa6a4461400738dab24daec13b47c9aba32dfd9815312d515
SHA512

0b45af7993d0e3fcddf9b85c2dc514a9afdf08cbd767d6410bf16c9125c271210f58f9ffc32cb4f99379fe3b4c57d31dc587c1a3d20df3780e1c7b6d83c4751a
SSDEEP

24576:Fd8VEKMOJIS9Q8YxbqAVmhH5YYhYr7Qw46rBhzvn53U3xtS/:FaEVOMyID94Mv53U3x0/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04f346e9dd09526a3d547d804716cae5_JaffaCakes118

Files

04f346e9dd09526a3d547d804716cae5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

897bb75fe81ae1929c7ba42a40a262ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
CreateProcessA
GetEnvironmentVariableA
CreateDirectoryA
GetProcAddress
LoadLibraryA
WriteFile
GetModuleHandleA
GetVersionExA
CloseHandle
GetTempPathA
DeleteFileA
lstrcpyA
WaitForSingleObject
LoadResource
FindResourceA
CreateFileA
LockResource
ExitProcess

setupapi

SetupIterateCabinetA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA

user32

wsprintfA
MessageBoxA

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ