2d65054721db1c981592351be85bd579_JaffaCakes118 | Triage

Sharing

General

Target

2d65054721db1c981592351be85bd579_JaffaCakes118
Size

9KB
MD5

2d65054721db1c981592351be85bd579
SHA1

34c0a6d00e471fd889b337a7b48f891d544ff7b5
SHA256

e8d8204454208d5a0c18812e06bef657cdad30d960a6346c2c64c86057312a65
SHA512

a1a99eaf61d954ccc83a0c0a91878da003002c181c07e5273bb712aa98fafab17446272d396e66adc95ac90a75c2bb5ac3c8be603d54f6a4b6d92651a32f19fd
SSDEEP

192:r0hl7mCGYXK8fQQErYt40PXY687uU05ZBKSJV8nKkIOdC/v:IhlyC7KGQIbFxkIOdqv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d65054721db1c981592351be85bd579_JaffaCakes118

Files

2d65054721db1c981592351be85bd579_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e12fbc10b4a3487465f6bce50d0fc058

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WideCharToMultiByte
GetModuleFileNameW
lstrcpyA
lstrcatA
WaitForSingleObject
CloseHandle
ExitProcess
GetModuleHandleA
HeapFree
GetProcAddress
HeapAlloc
CreateEventA
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
InterlockedExchange
VirtualQuery
VirtualAlloc
HeapReAlloc
GetFileAttributesA

user32

ShowWindow
GetDesktopWindow

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE