26e0b9a97a9448f2c6cccfd1003e0cb0_JaffaCakes118 | Triage

Sharing

General

Target

26e0b9a97a9448f2c6cccfd1003e0cb0_JaffaCakes118
Size

12KB
MD5

26e0b9a97a9448f2c6cccfd1003e0cb0
SHA1

2b770e58af6a26879be51f45ee279490fa0fd3b5
SHA256

9880ba4f93cade2f6bbb4cc8efdcf087e8ac51b5c209ee32ad8134eb87ef70e1
SHA512

2c7dfe45f2e33ea4067943a3d8911bd23421079cc5235c8bf78a19fe21ac925c362a4475d53ad3e65165c635cbd8b28b56bb643602fd6d9fdbaf1c2d430a336b
SSDEEP

192:qoKE8RHn3vYJA7P4oynWmDx6UvZopFCR7uA1+KN/qF5FmqGf+DYE:qomvKU48mD1MsR7ujsqGf+Df

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26e0b9a97a9448f2c6cccfd1003e0cb0_JaffaCakes118

Files

26e0b9a97a9448f2c6cccfd1003e0cb0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9e5aea87ea5c6b0582f110db0ccdb384

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

OpenProcessToken
LookupPrivilegeValueA

user32

wsprintfA

shell32

ShellExecuteA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
memcpy
memset

kernel32

VirtualAlloc
CopyFileA
LoadLibraryA
MoveFileExA
GetSystemDirectoryA
CreateProcessA
OpenProcess
VirtualAllocEx
VirtualFreeEx
GetModuleHandleA
GetTempPathA
GetTempFileNameA
DeleteFileA
lstrcatA
GetModuleFileNameA
CreateFileA
lstrlenA
WriteFile
GetLastError
CloseHandle
GetTickCount
Sleep

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ