33ede640129a7af25af0f1782d179485_JaffaCakes118 | Triage

Sharing

General

Target

33ede640129a7af25af0f1782d179485_JaffaCakes118
Size

9KB
MD5

33ede640129a7af25af0f1782d179485
SHA1

8d566e9b22eff38c281972db338990c0e9bf82f3
SHA256

dbce2c01e6073ed45b4eff4986dccf1515bb064093a3f9d528f17f50cc35d3fd
SHA512

085204bc4ce5cc1f04ba63200bc6ff7eab11997effe187c4f55fdad384e9c745659af3cd0a9559c8b84e75597c18cae9edacb7dc4101e2ff9a977387dcf904dc
SSDEEP

192:qXAAsJQwlvcxoDLIsewzzlucipRl08Bu7lR:qXJsv6oD/ztZSZu7l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33ede640129a7af25af0f1782d179485_JaffaCakes118

Files

33ede640129a7af25af0f1782d179485_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7b325348673febe539251b1fa8a9aba8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetCurrentThreadId
GetTickCount
GetTempPathA
lstrcatA
GetPrivateProfileStringA
CreateThread
lstrcpyA
CopyFileA
GetDriveTypeA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
VirtualProtectEx
GetCurrentProcess
GetLastError
CreateMutexA
GetCommandLineA
DeleteFileA
LoadLibraryA
GetProcAddress
Sleep
GetVolumeInformationA
CreateDirectoryA
lstrlenA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

msvcrt

fopen
sprintf
malloc
strstr
_strlwr
fclose

Sections

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE