17d0343f6d92e1cb1cf79f056d1ed3d0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17d0343f6d92e1cb1cf79f056d1ed3d0_JaffaCakes118
Size

7KB
MD5

17d0343f6d92e1cb1cf79f056d1ed3d0
SHA1

039137dc7661d030502bb0d8898c3ba3fd147346
SHA256

7023c2f9fef18f3e4c4bbdfa06196ecd55b44c06f1878a937430e266c5be8ab9
SHA512

b4f35af5cf091bd943cdc68cc921b7aaa0c1c259e3959f6b9ce87b17c69638d83eca27fdcbb7e871cb302409f4e33a2525f1c3ab6908605290245c8285de2aaf
SSDEEP

192:KR27oEiNAEe41Y97budrGfFKdKJzPsROp8sYS/:VMNePbisFKspppYa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17d0343f6d92e1cb1cf79f056d1ed3d0_JaffaCakes118

Files

17d0343f6d92e1cb1cf79f056d1ed3d0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4f061ee6065d178ba55bbc959b3dd784

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenMutexA
GetModuleFileNameA
lstrcatA
CloseHandle
lstrcpyA
GetModuleHandleA
GetProcAddress
VirtualFree
ExitProcess
CreateEventA
Process32First
LoadLibraryA
CreateToolhelp32Snapshot
CompareStringA
RtlUnwind

user32

BeginPaint

advapi32

RegCloseKey

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE