46c5ecf3334bd1ee3555c168608edab8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

46c5ecf3334bd1ee3555c168608edab8_JaffaCakes118
Size

5KB
MD5

46c5ecf3334bd1ee3555c168608edab8
SHA1

fa3c83aa22af0c0181ee38f9f4b1132c52b97c66
SHA256

dc59c187795184aa6515bb1c8abccb7b436b588bb79ac61a8211f8366271b261
SHA512

ca215a34c3252d6e94f2192cfad5dc06b19aaf84e64d14d48a7b842662be22ce8ab6e9ec6e5bcd14088229d4f2233ca09d55945bf0e6fe02b21a8ba45deae153
SSDEEP

48:i3Aa9uvY6uVg0dJ88RZR4gwrLOP5MYGqJXESlo/WfpMd1Ru1FsWT8QRRhBK0l9hL:Sdr88RtwYMYGqblYqpMBgsqi/cwTg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46c5ecf3334bd1ee3555c168608edab8_JaffaCakes118

Files

46c5ecf3334bd1ee3555c168608edab8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

14a2d7b58d3756be5c70b6c15220c9ed

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugActiveProcessStop
CloseHandle
Sleep
ExitProcess
GetExitCodeProcess
CreateProcessW
VirtualAlloc
DebugActiveProcess
GetModuleFileNameW
lstrcmpiW
lstrcatW
lstrlenW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
ReadFile
GetFileSizeEx
VirtualFree
CreateFileW

advapi32

RegCreateKeyExW
RegCloseKey
RegSetValueExW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ