3476c000b9eb9712a179840881a59a6b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3476c000b9eb9712a179840881a59a6b_JaffaCakes118
Size

104KB
MD5

3476c000b9eb9712a179840881a59a6b
SHA1

12ee98d16ebc58ad1866c73783743a756095a98b
SHA256

ee57a5e70a57ef82bb17b13692f0ce0a2e0f5cfb50cf9a1676ba35cf49abdb82
SHA512

9d01ebe15fc5c60acc459373f44fb3ebf8c47cfa5d4d24b739b3764910b18c31a5ec943cd09a8c1eed9bd2f572fd9ce10a606713e22e037cd26e224b2a4c9f14
SSDEEP

1536:CGRKwd7lGliFTF1SrlmQRd8ypyWEMWdqVqFu3A5grH6ZnBPr2gXht/PnM:CyKKgluTz+1pykWdQ+u3MP6Uht/P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3476c000b9eb9712a179840881a59a6b_JaffaCakes118

Files

3476c000b9eb9712a179840881a59a6b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ad82d7a61997191ce6b2a2614f92b531

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
CloseHandle
CreateProcessA
GetModuleHandleA
GetTempPathA
WriteFile
GetVersionExA
CreateFileA
lstrcpyA
LoadResource
FindResourceA
GetEnvironmentVariableA
LoadLibraryA
ExitProcess
CreateDirectoryA
SizeofResource
LockResource
DeleteFileA
WaitForSingleObject

setupapi

SetupIterateCabinetA

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA

user32

wsprintfA
MessageBoxA

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ