0d7ba6d016a41c547b2b5eddf9677a8a_JaffaCakes118 | Triage

Sharing

General

Target

0d7ba6d016a41c547b2b5eddf9677a8a_JaffaCakes118
Size

9KB
MD5

0d7ba6d016a41c547b2b5eddf9677a8a
SHA1

b54deb3d6cdfc1f5d2458a631740c267a277b24f
SHA256

df7ed2644b35eb758c9d02ecee1df432f7f989a5eadfeeec9c4f129b9984cb90
SHA512

3e32ba09c0cd08a693c16ed32f06008540ae177cc6d5e01e9d978184a2e3a9809820512304dfa5c1ab3df7d9ae9e08746bd2c8497c3c68910f26c702e88a6b5a
SSDEEP

192:XWMP8PPxPPl2crYQOtrPx423d6GwPHY68awkzai1enQmHhyezdNzr++IUK/v:mM2VmM5b7zar9IUCv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d7ba6d016a41c547b2b5eddf9677a8a_JaffaCakes118

Files

0d7ba6d016a41c547b2b5eddf9677a8a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

67f64dc42facb88ba12c7c0a92e5716b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
WideCharToMultiByte
lstrcpyA
ExitProcess
GetModuleHandleA
GetCommandLineA
CreateEventA
GetProcAddress
lstrcatA
CompareStringA
Process32Next
Process32First
CreateToolhelp32Snapshot
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
WaitForSingleObject
CloseHandle
SetFileAttributesW
WinExec
SetFileAttributesA

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE