5ed62492675e5577f5df02b349339195_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5ed62492675e5577f5df02b349339195_JaffaCakes118
Size

140KB
MD5

5ed62492675e5577f5df02b349339195
SHA1

a2ab864b397bb8d0bfc928cfb303a38b86809062
SHA256

968a4681faa63edd886df366ac9500ce42cd93bc5255432e17f892b7194cbd54
SHA512

9c2371cd467f2734e59e3e818ad2db8c61abc258dcc7327777a5c33345fa32ab131770f413a1aba4cae02b80e9198ef54b4a6173bf3de9ac29938021f63a2a3e
SSDEEP

3072:dH+NJA0JxOuHx+/efOrKo3876NCf/Xey:B+NS0HOY0qFGW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ed62492675e5577f5df02b349339195_JaffaCakes118

Files

5ed62492675e5577f5df02b349339195_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4174197468e9268a1f88db4701c81a38

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LockResource
LoadResource
FindResourceA
GetLastError
CreateDirectoryA
CreateProcessA
MoveFileA
DeleteFileA
GetTempFileNameA
SizeofResource
GetModuleFileNameA
WaitForSingleObject
CreateMutexA
CreateFileA
WriteFile
GetTempPathA
CloseHandle
GetStartupInfoA
GetModuleHandleA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

msvcrt

??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
strstr
strrchr
_vsnprintf
_beginthread
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ