39163aa6ed8281141ed07367d6310415_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

39163aa6ed8281141ed07367d6310415_JaffaCakes118
Size

292KB
MD5

39163aa6ed8281141ed07367d6310415
SHA1

368f9f6f479ddba066e498a6449aa5a27869e73e
SHA256

eb5815607dce629a84f483437d55ef33f27a099eb7baa162e3c5c3a23f78c3c5
SHA512

06fc374cfb1c4298c5e7ec9b5e522e57b823b0b22163f6c767400b776b0543b3c3019b715fe69e11ff0244aa731883bcfb99497d3c1feac353e15fb43bb41bce
SSDEEP

6144:6tUFngw8kiRrPr3PoAZml6GiFiEtenmf9WK/7xwLK2Z:6tEngtkiRPtZml9iYEtemf9WK/7+u2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39163aa6ed8281141ed07367d6310415_JaffaCakes118

Files

39163aa6ed8281141ed07367d6310415_JaffaCakes118
.exe windows:5 windows x86 arch:x86

02e5d4defbe79333a945748a4a6810c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

sprintf
??3@YAXPAX@Z
_ftol
memmove
modf
??2@YAPAXI@Z
strrchr
rand
strncpy
srand

shell32

ShellExecuteA

kernel32

GetEnvironmentVariableA
GetStartupInfoA
CreateProcessA
WaitForSingleObject
WriteFile
GetTickCount
CreateFileA
GetFileSize
WinExec
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
ReadFile

user32

wsprintfA
MessageBoxA

shlwapi

PathFileExistsA

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 271KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE