41a0304d9cc9c4618de260711e0f3771_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41a0304d9cc9c4618de260711e0f3771_JaffaCakes118
Size

23KB
MD5

41a0304d9cc9c4618de260711e0f3771
SHA1

dfa4ee1f2f5e68438822b2bbf2a3f4d4fa06c3a1
SHA256

38f1c50cfcd2ee25d80c95b3685a5f05d67ff24cf31a801b5aa61c666b42e978
SHA512

7eb9d8eda527a6bdab6f2cbd0b645d122bac30b1b62a6d7b1bb07fbee0b9c8b8e46ff59062063ae11d9d376421e7dceb481d3ce0aed9646b25ba3de9bf1f1803
SSDEEP

384:3IWVRd5Gv2umCQalsEEOq24/XM8olbzOfoX/sUj08Ye3ys:33dkmCeMBHDYe39

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41a0304d9cc9c4618de260711e0f3771_JaffaCakes118

Files

41a0304d9cc9c4618de260711e0f3771_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7a1477029a5551514d0b9c319792fd6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
OpenProcess
CreateProcessA
lstrcatA
GetEnvironmentVariableA
lstrcmpiA
GetProcAddress
CopyFileA
CreateRemoteThread
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
WriteProcessMemory
DeleteFileA
lstrcpyA
GetCurrentProcess
lstrlenA
VirtualAllocEx
CreateFileA

user32

GetWindowThreadProcessId
FindWindowA

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ