5c64be8217f67d71978638310a07b199_JaffaCakes118 | Triage

Sharing

General

Target

5c64be8217f67d71978638310a07b199_JaffaCakes118
Size

342KB
MD5

5c64be8217f67d71978638310a07b199
SHA1

ca2f4475614a678d7520ac361e01859112ce458b
SHA256

97242c4e64e7925bd73f1c8bdbd5ca75e25411ff1bba542806bb56c4b3e6e7de
SHA512

3de83d4c3c6e2b53e4630f122c308cc6e0f183b3d89e1786046c1ef395d61f7e2a7e632b92642546223f420e210539c76fadf75d605de9c8ea91dbf5ab90f40f
SSDEEP

6144:cUvv+vZMLxdoAlROTh0yIqM/zqPyFSF9I1M/q4cNoo+S/RtyW1Opw9v:9v+vsnbsl/hk1M/qrNooV/REWQpw9v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c64be8217f67d71978638310a07b199_JaffaCakes118

Files

5c64be8217f67d71978638310a07b199_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7b0061304054d179fe2e82f52b4df34a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FreeResource
GetDriveTypeA
GetFileAttributesA
GetLogicalDrives
GetModuleFileNameA
GetSystemDirectoryA
GetTempPathA
GlobalAlloc
GlobalFree
LoadResource
LockResource
ExitProcess
RtlMoveMemory
SetErrorMode
SizeofResource
Sleep
WriteFile
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
CreateFileA
CopyFileA
CloseHandle

user32

wsprintfA

shlwapi

PathFindExtensionA
PathFindFileNameA

shell32

ShellExecuteA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 337KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE