42d54e8d86f25b29b0f0cd98dff136d6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42d54e8d86f25b29b0f0cd98dff136d6_JaffaCakes118
Size

2.6MB
MD5

42d54e8d86f25b29b0f0cd98dff136d6
SHA1

350502eeec7c16874734e6521c19b420be142e69
SHA256

8cf8827d32072441983b28b05f69557eba5728e8d4288918c7f73cd084e3ed46
SHA512

c350a349d51032af1962aef6a44a62ea111f594652c58f7964f06960f7ef155f8dfd12badbd78f4b081be536d9b403d872a8c1aac4b7e50cdce2bc10f8615761
SSDEEP

49152:YLDgO/RRLasSag9+Fws4oU5uNvH3s577CY5CFmtghwRu0HFkU:SDgO/6sV/4o7X+77F5C0g2FS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42d54e8d86f25b29b0f0cd98dff136d6_JaffaCakes118

Files

42d54e8d86f25b29b0f0cd98dff136d6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1f1c9e40b72cae9c297f08170731eb34

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceA
GetComputerNameA
FreeLibrary
LoadResource
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
LockResource
SizeofResource
FreeResource
GetModuleFileNameA
GetProcAddress
GetShortPathNameA

user32

FindWindowA

advapi32

RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetUserNameA

shell32

ShellExecuteA

msvcrt

_XcptFilter
strcat
strcpy
strlen
fclose
fread
malloc
ftell
fseek
fopen
memcmp
strncpy
exit
fwrite
memcpy
memset
free
sscanf
strncat
realloc
_exit
sprintf
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

wininet

FindNextUrlCacheEntryA
InternetOpenUrlA
InternetOpenA
FindCloseUrlCache
InternetCloseHandle
FindFirstUrlCacheEntryA

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ