2b6081bb01fd1e74cc26b63c94f3db26_JaffaCakes118 | Triage

Sharing

General

Target

2b6081bb01fd1e74cc26b63c94f3db26_JaffaCakes118
Size

388KB
MD5

2b6081bb01fd1e74cc26b63c94f3db26
SHA1

29a824f6a550a7e433fbd587d77ef38282eaabd0
SHA256

2b6116bcf5036e03e860fdd15f953da811e3dae910e16762479f8c2150a528a2
SHA512

dd411beb7cea7a33039994454415fd0cd4b377dd36617527bf63df910be2d6a757bd6bfeb22238d85e58fbe3d44166f170b8e13064d25d966600e87e4d28eb90
SSDEEP

12288:mVJYQ7dTOwSNcWbHJsqWqXQDmTgj68KMTqLc3:mV+Q78QWbp37GqI3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b6081bb01fd1e74cc26b63c94f3db26_JaffaCakes118

Files

2b6081bb01fd1e74cc26b63c94f3db26_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f21b7edad07a173e70b47f571f2e033

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

ole32

CoInitializeEx
CoUninitialize

shell32

ShellExecuteW
ShellExecuteExW

user32

MessageBoxW
wsprintfW

kernel32

GetStartupInfoW
DeleteFileW
WriteFile
CloseHandle
VerSetConditionMask
GetProcAddress
GetExitCodeProcess
GetLastError
GetModuleHandleW
LoadResource
FreeLibrary
GetModuleFileNameW
CreateFileW
LoadLibraryA
SetEnvironmentVariableW
lstrcpyW
ExitProcess
CreateDirectoryW
GetCommandLineW
WaitForSingleObject
LockResource
GetTempPathW
SizeofResource
FindResourceW
RemoveDirectoryW

Sections

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 836KB - Virtual size: 834KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ