3627099650ddd912d0e45936b1eafb99_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3627099650ddd912d0e45936b1eafb99_JaffaCakes118
Size

7KB
MD5

3627099650ddd912d0e45936b1eafb99
SHA1

44f1ff506cdb1bf73b2b9d959eb3073fb664b8eb
SHA256

93452f07e3065138de8eab5a764c5b1d39bf443f0c479ecc054e49eb429e8271
SHA512

d143b2b105234cfce2dff95e03d123f67b27aa487af5be7cd12922b6b3d4e3317645afffe547f61fc08d2e1e7fe218897d47613172a712f4a16b93c25f4b2942
SSDEEP

192:PR27oEONMYa41Y97budrGfFKdKJzPsRapFYS/:UMhqfbisFKsVpFYa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3627099650ddd912d0e45936b1eafb99_JaffaCakes118

Files

3627099650ddd912d0e45936b1eafb99_JaffaCakes118
.exe windows:4 windows x86 arch:x86

13582fe4bdacf806605069ed470a64f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenMutexA
GetModuleFileNameA
lstrcatA
CloseHandle
lstrcpyA
GetModuleHandleA
GetProcAddress
HeapFree
ExitProcess
CreateEventA
Process32First
LoadLibraryA
CreateToolhelp32Snapshot
CompareStringA
RtlUnwind

user32

BeginPaint

advapi32

RegCloseKey

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE