394b86d809722db8b91f1ddfce750d99_JaffaCakes118 | Triage

Sharing

General

Target

394b86d809722db8b91f1ddfce750d99_JaffaCakes118
Size

10KB
MD5

394b86d809722db8b91f1ddfce750d99
SHA1

946a711e33021dabe62b7c36fde90038b7069086
SHA256

d496dddf648c6ae1d1e0bd7f01697c9397d93d5bd2ce95ed79c9c0fd0ab98d81
SHA512

0fa734e83e426b1577efc54efb139a5ad70946a89b98a52f83d42b517e7a76c2992b63aec900204b203d40dd1c0ea40eab0b793f645e72d7dbc3903b34971f5b
SSDEEP

192:SLTD6onobDyV7SM4o4feeEEZpaHaXVTkguI0:Sb3obw7TweUpGaFTkgG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
394b86d809722db8b91f1ddfce750d99_JaffaCakes118

Files

394b86d809722db8b91f1ddfce750d99_JaffaCakes118
.exe windows:4 windows x86 arch:x86

66b18ad74eb7db9d498d7ab6c08faba7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
WaitForSingleObject
CreateProcessA
WriteFile
CreateFileA
GetModuleFileNameA
GetTickCount
LockResource
LoadResource
FindResourceA
GetTempPathA
CloseHandle
DuplicateHandle
GetCurrentProcess
SetStdHandle
CreatePipe
GetStdHandle
GetModuleHandleA
GetCommandLineA

user32

LoadStringA
wsprintfA

shlwapi

StrToIntA

msvcrt

strcat
strlen
malloc
_strlwr
strcpy
strcmp

Sections

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ