2cae8adcca82865d9e726825b56dec60_JaffaCakes118 | Triage

Sharing

General

Target

2cae8adcca82865d9e726825b56dec60_JaffaCakes118
Size

20KB
MD5

2cae8adcca82865d9e726825b56dec60
SHA1

e1815ec893f9da4f51abcc1467b750969a50b71d
SHA256

11873c586c8989c37c999b06f36941a77e506438b7776dd84abda6b704d160dc
SHA512

57d7a02b3c37f1230cedd639567713e536ac5af86736bf72cdc60d7b455aeec88682e66a96cb11807768e19f116f19ec174a606f003164edf7526d6476ed0467
SSDEEP

384:0ultaxQHvcfKkD/hN6tBVuDYF4iCeA/Wd7Mqpeg3HK:RyyHEXDJN6PVuDmTPA+xTq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cae8adcca82865d9e726825b56dec60_JaffaCakes118

Files

2cae8adcca82865d9e726825b56dec60_JaffaCakes118
.exe windows:4 windows x86 arch:x86

313e31f420e79721b12f5df54327ede0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
ExitProcess
FindFirstFileA
GetEnvironmentVariableA
GetLastError
GetModuleFileNameA
GetShortPathNameA
MapViewOfFile
OpenProcess
Process32First
Process32Next
CreateFileMappingA
RtlZeroMemory
TerminateProcess
UnmapViewOfFile
WinExec
WriteFile
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
CreateFileA
CloseHandle

user32

MessageBoxA

shell32

ShellExecuteA

advapi32

RegQueryValueExA
RegOpenKeyExA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ