38844454b81adbd5e84f79e5b9167556_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

38844454b81adbd5e84f79e5b9167556_JaffaCakes118
Size

32KB
MD5

38844454b81adbd5e84f79e5b9167556
SHA1

adb935401d294accf381e04994f8fcf3b693255c
SHA256

d993dff864a77a948642e53abc42e232ba8ab311eb01546416556be3758a1ae4
SHA512

797d2e8099967b379ca58336cd7f3a87ce8d21721b68d87aeb86bbbf0b2190cd158baf03c3d7e896c48f95d6eb976ed53c41d2608834fda9f46324b3702f4331
SSDEEP

384:FqMEhba9OuUmlxhOQuyyl143Krh6oXnVg48JrX:FqMEo9Wyo143Mh6oUFX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38844454b81adbd5e84f79e5b9167556_JaffaCakes118

Files

38844454b81adbd5e84f79e5b9167556_JaffaCakes118
.exe windows:4 windows x86 arch:x86

82c4460510471a11e6f002f640d807dc

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
lstrcatA
CopyFileA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegCreateKeyA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ