2be055e73283949943b9482aaa105185_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2be055e73283949943b9482aaa105185_JaffaCakes118
Size

6KB
MD5

2be055e73283949943b9482aaa105185
SHA1

452d339bd01fc6e7871fdfc366ea1b2aa4f6ae1d
SHA256

dee0320a529c0666f85d6df3806d9d54e585567386ea1e3df1b93891b00a016e
SHA512

b03331618c53ff5c64e904568cc01263db161ce689929e4e56d730156ac98a18384e25c22113e5138d45d8df7a987396d1dcf0388fda4a6b9f71196d38e8cd38
SSDEEP

96:glgsCzKO2QlWeHQQSY9bSrDJc2h5XO2gJKL:oazH284Y54Vc2hBOyL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2be055e73283949943b9482aaa105185_JaffaCakes118

Files

2be055e73283949943b9482aaa105185_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b6382d0bc7c5510cc1ac22f3dec0e166

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

CharLowerA

kernel32

ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetWindowsDirectoryA
LoadLibraryA
DeleteFileA
VirtualAllocEx
VirtualFreeEx
WinExec
lstrcatA
lstrcmpA
lstrcpynA
CreateProcessA
Sleep

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 594B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE