3b37bdb748a86b06f652e702a22de377_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3b37bdb748a86b06f652e702a22de377_JaffaCakes118
Size

34KB
MD5

3b37bdb748a86b06f652e702a22de377
SHA1

a7a283f38828dd1922d9f330710a2ba3698b6de2
SHA256

5c93c4d8a3cfeeeb5d7d5aaccebb702b5be7b7b09f65a00db3c92b13e06ad347
SHA512

a599d1d714a4225f5d20f0d4eb3ee89e364090689d789ffd4613c5f786a1a11fdfd41c8cb70364acaa71233db8e36f1e9ffdddd0cb10fc3e5fa1d28563bdc211
SSDEEP

768:YxKYdZ65EDRJmPpFOxLfDPBzk7IfT9txf4BAB:YVjDREjs9Pfs4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b37bdb748a86b06f652e702a22de377_JaffaCakes118

Files

3b37bdb748a86b06f652e702a22de377_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7bf7bc612847cd5aab651efe3472bbca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
GetFileSize
DeleteFileA
SetCurrentDirectoryA
lstrcpyA
ExitProcess
GetModuleHandleA
GetCommandLineA
lstrlenA
GlobalFree
lstrcatA
GetLocaleInfoA
GetSystemDefaultLCID
GetVolumeInformationA
GetWindowsDirectoryA
HeapFree
GetProcessHeap
HeapAlloc
WriteFile
ReadFile
SetFilePointer
CloseHandle
CreateFileA
GlobalAlloc

user32

wsprintfA
CharUpperA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ