220f9d358848bb649e62a0d43f0ace15_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

220f9d358848bb649e62a0d43f0ace15_JaffaCakes118
Size

33KB
MD5

220f9d358848bb649e62a0d43f0ace15
SHA1

0f68dbc6363bfa8ccf24b89bf62a160ec26fd02d
SHA256

8103f50217ed8e26b845b36016761c2979190d3cc2e9143ecdbd46aa5aade8f0
SHA512

12cc6134784fbb59021518713d7963f8b10e05045b916b76be92cbfba7cb0a6edad39e1295613a241bf2ece3cf54c7d14711b10924a0e1e64d47d5b1b4360e76
SSDEEP

768:nFXDbPKWu+WHvHBTQLR49RSeIL7uAua8:xDbPmX/B79Yei7u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
220f9d358848bb649e62a0d43f0ace15_JaffaCakes118

Files

220f9d358848bb649e62a0d43f0ace15_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ced4007347d651ee31bfc3eec5a801b5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegDeleteValueA
RegQueryValueExA
RegSetValueExA

imagehlp

CheckSumMappedFile

kernel32

CloseHandle
CopyFileA
CreateDirectoryA
CreateFileA
CreateMutexA
CreateThread
DeleteFileA
FindResourceA
GetEnvironmentVariableA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
LocalAlloc
LocalFree
MoveFileA
MoveFileExA
OpenMutexA
ReadFile
SetCurrentDirectoryA
SetFilePointer
Sleep
TerminateProcess
WinExec
WriteFile
lstrcatA
lstrlenA

user32

ExitWindowsEx
GetDlgItem
GetWindowTextA
PostMessageA
EnumWindows

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE