4b7b8328aaaf0aa8f7403897ad9e6900_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b7b8328aaaf0aa8f7403897ad9e6900_JaffaCakes118
Size

25KB
MD5

4b7b8328aaaf0aa8f7403897ad9e6900
SHA1

e677b261b174824d911a1085dc6ce406caca9605
SHA256

e5b429cd18843f38307aff43e8720aa3c0eef58cfa46a06be4aa7b0838289e0d
SHA512

6aaf06c1bdaaad843b00faf0c7b626154d38d89b5f3b8794539171023ba705e388dbd5219e7857c13304e7a43563d482de3b0c531bdbecb154c98df4cc148a83
SSDEEP

192:vHHuOMH1uXNg62XkV8SBgryjEq9qIHxhGFTJofzLVCVFSpvsk15FxxCkCDD:vMYN9Oq9qIRhjzLQVc9TfxCDP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b7b8328aaaf0aa8f7403897ad9e6900_JaffaCakes118

Files

4b7b8328aaaf0aa8f7403897ad9e6900_JaffaCakes118
.exe windows:4 windows x86 arch:x86

030703f42853be0a2cf22cbbd472ad79

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegOpenKeyA
RegQueryValueExA

kernel32

AddAtomA
ExitProcess
FindAtomA
FreeLibrary
GetAtomNameA
LoadLibraryA
SetUnhandledExceptionFilter

msvcrt

_fstat
__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
exit
fclose
fflush
fopen
fprintf
fread
free
getenv
malloc
memcmp
memset
setbuf
signal
strcat
strcpy

shell32

ShellExecuteA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 192B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE