279ed2ece9be13826650b244518daa2b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

279ed2ece9be13826650b244518daa2b_JaffaCakes118
Size

70KB
MD5

279ed2ece9be13826650b244518daa2b
SHA1

1097f0758a4b6284cc3884aaa5bf7dca0d8f3d65
SHA256

60be551b97d2cef0e1c9f3a21174b719593f184c04bc9709fa09ff086bf9ee54
SHA512

e1e953371d7977cfd53ba10f447d2a9f1560082ed6d4227dec031b02e23274cf2233fceeb1fd9feb3f61db80cf20e7e3473ba5a249cfafa605dfcbb0741c7163
SSDEEP

1536:pw/KtmTTRCIt3IsCoxu8pZ3sBGyOtORRdRDYyJR:pkeiIqSou8pdsB3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
279ed2ece9be13826650b244518daa2b_JaffaCakes118

Files

279ed2ece9be13826650b244518daa2b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f7ef04408bc0dd5a603b43623437345

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetEnvironmentVariableA
lstrcatA
lstrcpyA
LoadResource
GetModuleFileNameA
ReleaseMutex
WaitForMultipleObjects
CreateMutexA
LockResource
SizeofResource
LoadLibraryA
GetProcAddress
GetShortPathNameA
FreeLibrary
GetModuleHandleA
GetStartupInfoA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

msvcrt

free
strcpy
calloc
strlen
fclose
fwrite
fopen
malloc
strcmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strcat

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ