3a84c14ce4e8086211bbf6acc4103f77_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a84c14ce4e8086211bbf6acc4103f77_JaffaCakes118
Size

12KB
MD5

3a84c14ce4e8086211bbf6acc4103f77
SHA1

75f8488de3737fca0aae1181693528884efb4810
SHA256

482ad4d25a1263458e70323703bcb9d1ee60d40215c8437158510761a0f2e80c
SHA512

c58762f19bc08e92170d2de19ee0c3eede5936467d802096275583bde516a935b674e2b4070f401b62ad9b01791cff78889f4eff37fc419b4aba1c5837178da2
SSDEEP

384:aaz+M7wF8CRM7KyLRb6DJwguQqNEe1rv:FB0aCRMhLRml2Zyed

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a84c14ce4e8086211bbf6acc4103f77_JaffaCakes118

Files

3a84c14ce4e8086211bbf6acc4103f77_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1001a132b3d13e8be973e23ce967f7da

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
OpenEventA
SetEvent
Sleep
lstrcatA
DeleteFileA
lstrcpyA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
CloseHandle
VirtualQuery
InterlockedExchange
ExitProcess
GetModuleHandleA
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
OpenProcess
CreateFileA
GetFileAttributesA
GetTempPathA
Process32First
CompareStringA
TerminateProcess
VirtualAlloc
HeapReAlloc
RtlUnwind

user32

wsprintfA
CharToOemA
MessageBoxA
ExitWindowsEx
ReleaseDC
DestroyWindow
IsWindow

gdi32

RestoreDC

advapi32

RegDeleteValueA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE