448bae63754ec7ba44390227d32e0269_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

448bae63754ec7ba44390227d32e0269_JaffaCakes118
Size

4KB
MD5

448bae63754ec7ba44390227d32e0269
SHA1

4606e3b3bcc336e2c2b37ad07f968827bc2a643c
SHA256

153b829f972bea146a42545dd08b24deca5353c44a8ce14507352155e2cd5e41
SHA512

ad20a074bc24c53a362c341044c26bfd55b8ac67e5c7c843e1826caa6544f77030623c552ae78bbf2974ab765236d0e691ec1f624712c21ca7d72dcd00473dfc
SSDEEP

48:yBX07oO+X/ZqphBGI8xpyWmiKEq5svYcnJmcO0XIa0l:uX0ghqfEhBmiBquhnw60

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
448bae63754ec7ba44390227d32e0269_JaffaCakes118

Files

448bae63754ec7ba44390227d32e0269_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e33b108faa20fb02583b6cdc05a3c20f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord922
ord540
ord4277
ord537
ord800
ord858
ord6663
ord4129
ord2763
ord5683
ord4278
ord924

msvcrt

memset
?terminate@@YAXXZ
strcpy
_except_handler3

kernel32

lstrcatA
GetShortPathNameA
HeapAlloc
GetStartupInfoA
GetCommandLineA
ExitProcess
Sleep
GetModuleHandleA
GetProcessHeap
lstrcpyA
GetModuleFileNameA
CreateProcessA
GetEnvironmentVariableA

advapi32

RegOpenKeyExA
RegQueryValueExA

shell32

ShellExecuteA

Sections

.rdata
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uro
Size: - Virtual size: 1B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE