481dcd5799e9208f244444ea47bb06f2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

481dcd5799e9208f244444ea47bb06f2_JaffaCakes118
Size

29KB
MD5

481dcd5799e9208f244444ea47bb06f2
SHA1

5d8aa2d80d7adee8b9afcf5f5c7c6461c7a4bca0
SHA256

ece31338b292835d0a9d662db7024503744d571c899a2b934ce183cfdac75dfd
SHA512

024c20197c9e2c7032c11f54b8a4c247ec38ec9bd225aa50190492551b02b4358c9742c310f23c34f5e197172914e688bc42f999a2570048b5eccb4bfb348513
SSDEEP

768:cYpo1SYOdYXRaHq/cEuC79p+BHX+Jv3/1sF:US4XRaHiV9p+kv3/s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
481dcd5799e9208f244444ea47bb06f2_JaffaCakes118

Files

481dcd5799e9208f244444ea47bb06f2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE