17ce970d4fc83db1b63ff63eaa8cd3e1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17ce970d4fc83db1b63ff63eaa8cd3e1_JaffaCakes118
Size

2.0MB
MD5

17ce970d4fc83db1b63ff63eaa8cd3e1
SHA1

5dc863c6f65b84b3d4a12597521324fa1bc0e166
SHA256

979d9752053fc234f3e6e8aaedd22c3f5fafcc7175b2f484f8b106e6470ca476
SHA512

ddf4c3273ac51244cd6d4bed9a809e261e0f2a11c08df12a845c66b1b0a8a63b8222e17bb3f653d53087704be6388f94f90e893da4fe5090b1caac39ae1fb2c4
SSDEEP

49152:nJIuDCb4MhXmrBs8YvSWM0IVcvsvCPiP9CH8YXuuG2upGL1iE7IdPDFB:nJIuDCb4MFmrFiHIMKccYXuV2fTE1DFB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17ce970d4fc83db1b63ff63eaa8cd3e1_JaffaCakes118

Files

17ce970d4fc83db1b63ff63eaa8cd3e1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f1f4aac70b9aaaf29f1c51ecd11a3a52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mini_installer_full.pdb

Imports

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

kernel32

lstrlenW
lstrcmpiW
GetCommandLineW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
CopyFileW
DeleteFileW
GetLastError
EnumResourceNamesW
LocalFree
lstrcatW
GetModuleFileNameW
RemoveDirectoryW
CreateDirectoryW
GetLongPathNameW
GetTempFileNameW
GetTempPathW
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
WriteFile
CreateFileW
LockResource
LoadResource

shell32

CommandLineToArgvW

shlwapi

StrStrW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24.5MB - Virtual size: 24.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ