3e1657b1e9e838c4771af995bf35892a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3e1657b1e9e838c4771af995bf35892a_JaffaCakes118
Size

8KB
MD5

3e1657b1e9e838c4771af995bf35892a
SHA1

07669404d853be5918a8c71042834045c5673285
SHA256

0bb06e0cd561ee6dceb03ee662fc2a8f712e3fcda8ba357f76564078ad35750a
SHA512

fc38c794c2f3ca8e2fa935d91cae0141327c9022df150e1e93b167d51c19f2a49af8492c31b0b254efb1898efccf629725eca3a96d50481253fd1d4c99a2c598
SSDEEP

192:RNUIS/UHZins/aETD1NWh3b2fCBucAlNU4+BW7lm:oIS85J/TTjWhL2aBMle4oW7l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e1657b1e9e838c4771af995bf35892a_JaffaCakes118

Files

3e1657b1e9e838c4771af995bf35892a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ff00b01eec733ab02fc33cf506d4aa5c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetCurrentThreadId
GetTickCount
GetTempPathA
CreateThread
lstrcpyA
GetPrivateProfileStringA
CopyFileA
CreateDirectoryA
GetDriveTypeA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
VirtualProtectEx
GetCurrentProcess
GetLastError
CreateMutexA
GetCommandLineA
DeleteFileA
LoadLibraryA
GetProcAddress
Sleep
GetVolumeInformationA
lstrcatA
lstrlenA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

msvcrt

fopen
_ftol
sprintf
malloc
strstr
_strlwr
fclose

Sections

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE