40671e5e9de2992305eb2f22a042e46a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40671e5e9de2992305eb2f22a042e46a_JaffaCakes118
Size

36KB
MD5

40671e5e9de2992305eb2f22a042e46a
SHA1

9fb446794bd7ec5076cb71f5075657e5f314c4f4
SHA256

7ed46fb64c51aae0d6ca83b06915275fa7918af5eec9f96b7c14eb01009119b8
SHA512

1570fd209cec121bc319b55471f03260d0390ec05e2dcf51351851a068ec8ccbf23812ac6348457ecb87e78bc256c390e4100454d3fa33886774092e284ee236
SSDEEP

768:VeziZ9Un6BnqESQA9zyf5/wkGlP16r51jLJ7Eaxp:Vy2uKnjSfu/wkyArhEM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40671e5e9de2992305eb2f22a042e46a_JaffaCakes118

Files

40671e5e9de2992305eb2f22a042e46a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c3e6106e1e3aeb8cff14ba27e6694690

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadProcessMemory
lstrcpyA
CreateProcessA
lstrcatA
GetWindowsDirectoryA
DuplicateHandle
GetCurrentProcess
OpenProcess
VirtualFree
VirtualAlloc
ReadFile
GetFileSize
CreateFileA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
VirtualProtectEx
lstrcmpA
CopyFileA
DeleteFileA
SetFileAttributesA
WriteFile
lstrlenA
GetSystemDirectoryA
SetFilePointer
GetModuleFileNameA
ExitProcess
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
CreateRemoteThread
SetLastError
GetCurrentProcessId
GetPriorityClass
WriteProcessMemory
Sleep
GetModuleHandleA
GetProcAddress
WaitForSingleObject
GetComputerNameA
CloseHandle
ResumeThread

user32

FindWindowA
GetWindowThreadProcessId
wsprintfA

advapi32

RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
GetUserNameA
RegSetValueExA

shlwapi

SHDeleteKeyA

msvcrt

atoi
free
malloc
_strnicmp
_strrev
strrchr
strncpy
strchr
_stricmp

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE