628d0f1a648635d925bfea0d8fe8aa13_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

628d0f1a648635d925bfea0d8fe8aa13_JaffaCakes118
Size

36KB
MD5

628d0f1a648635d925bfea0d8fe8aa13
SHA1

3fd1d0dbff26cb175f991338fd89c3d89816047f
SHA256

6da52896de81079cc6e80695ae2e0fa10d5e5a5774adedfff3833d3f082a2c35
SHA512

1a7aab8b38f4c8beb79accc30a8457786e8a01527b3c0f812a357f68df1adbed50d2d344da16bac478a115667bb830ac3af63af24805742fcefff7116a6670f8
SSDEEP

768:zyjigH2DSe9G+MJqzlznFebyhuzrPqlIu798a27TF/6xLyPBinxomSbnJOM:zyjZH2DSGG+Mc3IzmlIuZ8ph/oGYxhuJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
628d0f1a648635d925bfea0d8fe8aa13_JaffaCakes118

Files

628d0f1a648635d925bfea0d8fe8aa13_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8d68c2d66cc9e4a33fa518eb7adf8817

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetFileTime
GetTempFileNameA
GlobalAlloc
GlobalFree
DeleteFileA
SetFileTime
VirtualProtect
WriteFile
lstrcpyA
lstrlenA
CreateFileA
MoveFileA
CloseHandle

advapi32

RegOpenKeyA
RegQueryValueA

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 462B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ