400182294f39278bf66942bc8eec95f6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

400182294f39278bf66942bc8eec95f6_JaffaCakes118
Size

14KB
MD5

400182294f39278bf66942bc8eec95f6
SHA1

6609f8834a2db42e80f4dd4ba1695c3c72dd3fc4
SHA256

56f980ab2e04666ebd2c2ef9c8a23cdf2a1e761504c919b9082a7dda96babc5c
SHA512

74c38ffd96ed5e1ffb3e1693e3ce8efd046a587fee05990e5e6f517fc57622851eb47ce9ecff85dfd7f6d68804595c2cba683a2b59c2b891c976d6e972a68431
SSDEEP

192:rpP58rtOGExqoYO5QbtE4N4fdWqSCZkeWdx9jFFK22ICqGlTFl+IMHJ:P8IG6YZEm8LkesjvK28Rp3+IG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
400182294f39278bf66942bc8eec95f6_JaffaCakes118

Files

400182294f39278bf66942bc8eec95f6_JaffaCakes118
.exe windows:6 windows x86 arch:x86

c688ff7a0202f07cf85b0be211fed00f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\programs\backtothefuture\wldropper\objfre_w2k_x86\i386\WLDropper.pdb

Imports

advapi32

RegSetValueExA
RegCreateKeyA
RegCloseKey

kernel32

HeapAlloc
GetProcessHeap
HeapFree
FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
CloseHandle
WriteFile
CreateFileA
ExitProcess
CreateProcessA
GetEnvironmentVariableA
lstrcatA
GetShortPathNameA
lstrlenA
lstrcpyA
GetCommandLineA
MoveFileExA
GetVersionExW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 314B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ