22f963b050041e3bb1045fecb00f3c04_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

22f963b050041e3bb1045fecb00f3c04_JaffaCakes118
Size

18KB
MD5

22f963b050041e3bb1045fecb00f3c04
SHA1

daf53e7dc359be8efba49a8438fc083d2ae942ca
SHA256

14fffa26f64c8038070d4469e7fd16787fb220bf97d98fb6400df1b2e6a55708
SHA512

99c8ad4d874af84d936c18ce905b5c4289c53f24114c3f2981c2e1e1ef101ffe74d7b835e93c9ddb7938a990d6b679c62c2c74d2a6255a33c20902c22912b62f
SSDEEP

384:+k3Gb4BefwU14s8vQqrhRO7u/5cBkWBeOWQ:RBUunnOc5wf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22f963b050041e3bb1045fecb00f3c04_JaffaCakes118

Files

22f963b050041e3bb1045fecb00f3c04_JaffaCakes118
.exe windows:1 windows x86 arch:x86

d2345ae108e27a22b62ad5f83211e107

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
CreateMutexA
CreateProcessA
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
GetLastError
GetStartupInfoA
GetTempPathA
GlobalAlloc
GlobalFree
RtlMoveMemory
Sleep
WaitForSingleObject
WriteFile
lstrcatA

user32

CreateDesktopA
EnumWindows
GetMessageA
PostQuitMessage

shell32

ShellExecuteA

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE