2a6b9181bbf059300d11689a2851f7c0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2a6b9181bbf059300d11689a2851f7c0_JaffaCakes118
Size

17KB
MD5

2a6b9181bbf059300d11689a2851f7c0
SHA1

189e16bef01b2653aafac531c64db9ca90fbfcaf
SHA256

2379d9f5e299f9ef0d9e81122cfd4a535792392acbcaedcf40e05103d39f166e
SHA512

67edc547852b75e8ee8ed70626af279ff9ee3ebb45199849a63671ebe336b71785bf003d2f7984ea43f0512cde56f25a3a0ce7ba32c469d5c8c686adcc8fbe28
SSDEEP

384:SCv8oA/taBSheCGcMJxDTHfRmRc6XEXpeWQfQ:BkBVaUMTDT/RmRZXtfQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a6b9181bbf059300d11689a2851f7c0_JaffaCakes118

Files

2a6b9181bbf059300d11689a2851f7c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0dfaef7a8817ea6f646c138597586e0e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
ExitProcess
GetLastError
CreateMutexA
CopyFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleFileNameA
FindNextFileA
CreateProcessA
Sleep
CreateRemoteThread
DuplicateHandle
GetCurrentProcess
WriteProcessMemory
VirtualAllocEx
OpenProcess
WinExec
CreateThread
SetErrorMode
WaitForSingleObject
CloseHandle
FindFirstFileA
GetModuleHandleA

user32

GetWindowThreadProcessId
FindWindowA

advapi32

RegSetValueExA
RegOpenKeyExA
RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ramius
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ