494803368557d12d52b4e9528f9f0616_JaffaCakes118 | Triage

Sharing

General

Target

494803368557d12d52b4e9528f9f0616_JaffaCakes118
Size

4KB
MD5

494803368557d12d52b4e9528f9f0616
SHA1

bbce7d53e3b3ddb87dd026640d0b420124ba49c7
SHA256

b4009e09988056b41ebdff0da2f9fae56d11b4d56b0e7a37708634649000aa97
SHA512

251f712c06f2f706c65ef5289dd7c5fd861362c1d0b000246a5f4dbcad59dcf4d946dc49c1c03d8e36307a2153c72b452c2847a1e2b8d151f3456366d4a227e9
SSDEEP

48:iiFWl3FaLkELTPcRnxtnmlxzvUyJ/7nt8SntvD5o1UsA35GuWwjvwBCh/8DA:yavcRnOl9vUebjV5ohk5bjvwBi/8U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
494803368557d12d52b4e9528f9f0616_JaffaCakes118

Files

494803368557d12d52b4e9528f9f0616_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c52d88f7b99f3d30819bcbaec315afb2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
CloseHandle
VirtualProtect
LoadLibraryA
GetProcAddress
MoveFileA
GetModuleFileNameA
lstrcatA
DeleteFileA
GetLocalTime
CopyFileA

advapi32

RegRestoreKeyA
RegDeleteKeyA
RegOpenKeyA
RegSaveKeyA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

msvcrt

exit
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
strstr
__CxxFrameHandler

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE