3537942926169df4e48ec4d63a804841_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3537942926169df4e48ec4d63a804841_JaffaCakes118
Size

35KB
MD5

3537942926169df4e48ec4d63a804841
SHA1

7e9923de3df90adb7a34f6de9678f231e82ce48a
SHA256

848e5aeb26fc1121d52a246dfecb4f3d5076d2f306cac69b93c1010ef36a963c
SHA512

368d8c920029e3acccab940d8796e52b9c6d90f3f256445ece6453122dcca1add385de350a446f9ca533366344bff60d0acf1b4c80fdde0a527a875c3d4eb067
SSDEEP

768:RYpo1SY3dYQ/PsvLNtUHoQ7TkcQzE8FjV9kHsJ6+4HDax:tSnQnqLQIQUcQzE8FjV9QsJx4H2x

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3537942926169df4e48ec4d63a804841_JaffaCakes118

Files

3537942926169df4e48ec4d63a804841_JaffaCakes118
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

wjlbbcn
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE