2b5af4b3311583bf444c20d6a9f7f3e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b5af4b3311583bf444c20d6a9f7f3e0_JaffaCakes118
Size

182KB
MD5

2b5af4b3311583bf444c20d6a9f7f3e0
SHA1

10c9273228688d3e732efdc67edd1742cc78ef8c
SHA256

9afc35dc616b5c6049bed7b4cb7165fb80a6e66f21eab5bcc4fcb9e6de5263d9
SHA512

6d940303fbed5819ddfe6b6b13109cf46a232a0883b7abbab55a6d044c0e9ac1438b27da72e24696880d8a64c0653a55c27aaacf2427579c7b106ac2f255f186
SSDEEP

3072:NnURTXJ+MirOeLnPSvBI/e/jaugWT7Hdb+eAFnuvX/fSBam97EVUWW:N69iieGva2jqW9b+DFufWJFEVUZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b5af4b3311583bf444c20d6a9f7f3e0_JaffaCakes118

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

2b5af4b3311583bf444c20d6a9f7f3e0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE