363be5c0a5b7f745956b38c88cacb5af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

363be5c0a5b7f745956b38c88cacb5af_JaffaCakes118
Size

4KB
MD5

363be5c0a5b7f745956b38c88cacb5af
SHA1

cce9d05b6988084245ef7c792297e39283d9a848
SHA256

1c71c4fdc3833c1d1528a0178d6c0d10aa7b6f273d6ffdf7ca1304adcb95960e
SHA512

55161f8d1eb4ec28f6dc7ee939a009d4f4ef834e33d5aa1aca376722a3031d65c9e28ca595c271f4fb273ba34f0a0a2c78de5c9f6ebc8c6e20ec7ad511881867
SSDEEP

96:dAjje3ktjfKIGN3lsc1Dt6vaZJxlMCohM:IrbKNqc1Dt6vaJjvohM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/sof2violpwd.exe

Files

363be5c0a5b7f745956b38c88cacb5af_JaffaCakes118
.zip
sof2violpwd.c
sof2violpwd.exe
.exe windows:4 windows x86 arch:x86

120c606abc82ae64c5f50069757742f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

ExitProcess
GetDriveTypeA
GetLogicalDrives
GetVolumeInformationA
SetUnhandledExceptionFilter

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
atexit
exit
fgetc
fwrite
printf
puts
setbuf
signal
sprintf
strrchr

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 532B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 144B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE