3137346b34312f667d6f87d47197a34f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3137346b34312f667d6f87d47197a34f_JaffaCakes118
Size

92KB
MD5

3137346b34312f667d6f87d47197a34f
SHA1

dcaa512601db74a2f5d4bd792fb21758bc2f826d
SHA256

a50c957dd05925d0e0ee75261b0b47304903c612020d420ecb9bb9a4fbd705b0
SHA512

07de2da09ad136062c1b6b15f63af01d67884115ee3f58e25b9b78677b8c947e0b4194c570dd39e4a88cd140b032bf55e30d692a45d50fbb32577538f6d533f6
SSDEEP

1536:HN/74GPIW+VMlM+IiCtyf5n/zLwxOq1Qcc8iO7I4KPc/3WPVDMjtbJT:9pPITP+h15n/zW3ycU7UetDM5F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3137346b34312f667d6f87d47197a34f_JaffaCakes118

Files

3137346b34312f667d6f87d47197a34f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

543c9cc540f6b4306c1cac9e251f71a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

strncmp
perror
malloc
free
exit
fread
fopen
fgets
strrchr
fclose
fwrite
printf
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
sprintf
getenv
_XcptFilter
_iob
fprintf
_exit
__p___initenv
_strdup
_stat

kernel32

GetModuleHandleA
GetModuleFileNameA
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.drdata
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE