0e89d6cf0e737454e3c99347ea8da957_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0e89d6cf0e737454e3c99347ea8da957_JaffaCakes118
Size

112KB
MD5

0e89d6cf0e737454e3c99347ea8da957
SHA1

bb11f6eba5f43520df33c60add7deeea303a3568
SHA256

aec5cc391eab6dcb9c2a68600ed546bce9a6322021eca6d5127450b83a74ce34
SHA512

e002f0406ec101ab704817732c10121b3a8122747f32ac76129d4bd046b667d0175ad15154ec80427ad6267bd808ecf978983b84f26d106005c8e3def06581ec
SSDEEP

1536:Va5XdpktLhfOFKSPHjozjXsLTZVTlBS9JFKKDCmop9ua:w5XdWhfSv2X59JF9DJop9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e89d6cf0e737454e3c99347ea8da957_JaffaCakes118

Files

0e89d6cf0e737454e3c99347ea8da957_JaffaCakes118
.exe windows:4 windows x86 arch:x86

894e6913cec38d569e6765be9e480fed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
FreeResource
CloseHandle
WriteFile
CreateFileA
GetEnvironmentVariableA
LockResource
LoadResource
SizeofResource
FindResourceA
WinExec
ExitProcess
GetSystemDirectoryA
GetModuleFileNameA

user32

wsprintfA

advapi32

RegSetValueExA
RegCreateKeyExA
RegCloseKey

msvcrt

strcat
strcpy
fclose
fread
fseek
fopen
fwrite
memset

Sections

.text
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ