4304009da35f3b0c86d943e0c59d5ef0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4304009da35f3b0c86d943e0c59d5ef0_JaffaCakes118
Size

100KB
MD5

4304009da35f3b0c86d943e0c59d5ef0
SHA1

e9df68a94e9e83df48afb1446930d869db0e968b
SHA256

7bb50c17e655899c1f9fca6f5ee4cc19df3ab402a7346c9a1a5d570e8cafba9a
SHA512

7287a707399d5f9c9cb3c99a9761b683a80df5e83cc9ea9751055aa26af2c995c291df2629475acaeda567e454557014cdc8541ac48ed686b81ab0d089d8f90f
SSDEEP

1536:TN/7/WQBVYghP725G85p+VN32ebt5bPRmUikIYQJ6Nu40Xubd6:ZuNySsVdfbvbPRmUik+5Lebd6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4304009da35f3b0c86d943e0c59d5ef0_JaffaCakes118

Files

4304009da35f3b0c86d943e0c59d5ef0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

543c9cc540f6b4306c1cac9e251f71a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

strncmp
perror
malloc
free
exit
fread
fopen
fgets
strrchr
fclose
fwrite
printf
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
sprintf
getenv
_XcptFilter
_iob
fprintf
_exit
__p___initenv
_strdup
_stat

kernel32

GetModuleHandleA
GetModuleFileNameA
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE