59a3a844b0ee46f2a8aaab591168090f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

59a3a844b0ee46f2a8aaab591168090f_JaffaCakes118
Size

7KB
MD5

59a3a844b0ee46f2a8aaab591168090f
SHA1

2a2b78380ac383af0ce79b0c7ec8b08da8b4f6e4
SHA256

cb495a2daaeda9b4711d7600e16e2c11ff1ea33db8c42f64d8a68a09f0e2a5df
SHA512

e76dfe337eae0148dfd8cff3abc6158259fbcec9adc4028d41e2a2a73846fc56d8a42e67fb959b06b18f24935685a1d27ea1b87d9b82ddf589fa8a5efbd2abd9
SSDEEP

192:YiIxIOfQyrEh/pAZHb9zHJjaVgH4oynCQ:YiIxeUEh/uZ7XaVgH4b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59a3a844b0ee46f2a8aaab591168090f_JaffaCakes118

Files

59a3a844b0ee46f2a8aaab591168090f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

51b4e7e7a6ecc58079b459231c112434

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
Sleep
GetTempFileNameA
CreateProcessA

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

wininet

InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle

urlmon

URLDownloadToFileA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
strlen
??2@YAPAXI@Z
printf
memset
strcat
memcpy
_exit
_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE