607819197634988f7d7bd651748b7870_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

607819197634988f7d7bd651748b7870_JaffaCakes118
Size

99KB
MD5

607819197634988f7d7bd651748b7870
SHA1

db06af4dde4eecf2b4681e1ef2ccc160acf03a9c
SHA256

cdc1e7374a8ea0856af81964e1a50687810abb04269fd659b4f2e243ef5f49dc
SHA512

aa3ef4e6aace2179dc3f872eee962a2e46e45102cc7825de89df1c1207dd68250179439a71595b6af78b0845cc08009d1785f5ac83cb6dd485dbe1322bdf08b7
SSDEEP

3072:ZmlPCBzkWa3Dx+Cc6Oc5Z5/WYsa0afFGG3:glj1+FcX5uBifFd3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
607819197634988f7d7bd651748b7870_JaffaCakes118

Files

607819197634988f7d7bd651748b7870_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4a3fe7424ee4f152e424518bec1a172c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??2@YAPAXI@Z
malloc

kernel32

VirtualAllocEx
lstrcpyA
WriteProcessMemory
ExitProcess
GetEnvironmentVariableW
CreateProcessW
GlobalAddAtomA
CreateRemoteThread
WriteFile
Sleep
CreateFileW
lstrcatA
GetEnvironmentVariableA
GetShortPathNameA
GetProcAddress
CloseHandle
GetModuleFileNameA
GetModuleHandleA

user32

wsprintfW

shell32

ShellExecuteA

ole32

CoCreateGuid
StringFromGUID2

ntdll

memset

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 398B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ