2d90b3020e71b5f2488d4a9d92456b42_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2d90b3020e71b5f2488d4a9d92456b42_JaffaCakes118
Size

7KB
MD5

2d90b3020e71b5f2488d4a9d92456b42
SHA1

24ed354d23a196896c0013a8551e93f03a9dbe22
SHA256

e9f0fcaab3ca18d2cab455ab1a3d2607d04c90dcec839a1991f54142b119f371
SHA512

49c79aee313c0928d26a0c4eb35b78ce345b76dec169282745e80eb2726c1369767c0df86e5f1285383182d3f68baec29e1674b898de8e539ce7bda2fba14360
SSDEEP

192:8mhnUyxUFv9zGeZM8KjD7aJORGBs7/v/v:Dnnxq5K9/Xv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d90b3020e71b5f2488d4a9d92456b42_JaffaCakes118

Files

2d90b3020e71b5f2488d4a9d92456b42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

025fa7c6143473d6913714ca9f0f0d14

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileAttributesA
GetModuleFileNameA
lstrcatA
CloseHandle
lstrcpyA
GetModuleHandleA
GetProcAddress
VirtualQuery
InterlockedExchange
ExitProcess
CreateEventA
LoadLibraryA
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
SetEvent

user32

EndPaint
BeginPaint

advapi32

RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 672B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE