3cd8e36564dbb0e558205fb96d982402_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3cd8e36564dbb0e558205fb96d982402_JaffaCakes118
Size

145KB
MD5

3cd8e36564dbb0e558205fb96d982402
SHA1

a03d8fd99675fd48f578e4e84b5b656a26f41e6a
SHA256

b6c595c34ab90f36b96de41688cef6f6480b7debae260d9bc156224b25758013
SHA512

125868e0f09fcfc255cc24fdb8a5abd9b2376b6c4dd9a8b16bcfef2f876bdde721a9870f6f30b5d80bf90522df8dc84cf0573bfb1597432d40fcb22d7afa6d8a
SSDEEP

3072:Rs5sxY5rYqRF+trw86fFjLVZP3PmlnrUyEnGUmnkn3efnnuFR:ch5rYqaFx6fBLzP3PeUUpfA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cd8e36564dbb0e558205fb96d982402_JaffaCakes118

Files

3cd8e36564dbb0e558205fb96d982402_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f1e3b0d5848986896fef6d32b9d66458

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetSystemDirectoryA
TlsAlloc
CreateFileA
CreateProcessA
WideCharToMultiByte
GetFileSize
GetFullPathNameA
GetModuleHandleA
FreeLibrary
GetLastError
LoadLibraryExA
TlsFree
TlsGetValue
MultiByteToWideChar
CloseHandle
TlsSetValue
LoadLibraryA
lstrcpyA

advapi32

RegCreateKeyExA
RegEnumKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegQueryInfoKeyA
RegCloseKey
RegOpenKeyExA

ole32

StringFromGUID2
CoUninitialize
CoTaskMemRealloc
CoCreateInstance
CLSIDFromString
CoInitialize

oleaut32

LoadTypeLi
LoadRegTypeLi

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1022B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ