62ec7534d512ba26b73037448b248100_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

62ec7534d512ba26b73037448b248100_JaffaCakes118
Size

6KB
MD5

62ec7534d512ba26b73037448b248100
SHA1

e78034800eb415c2f323a121cb4442154ed082f9
SHA256

b397bb3200ff31d01b44e59c8a7242d504c1ee41a79c2f2e06f0ab3e1d3bc982
SHA512

bb645da051dd1738d5c18cb45a4271dd468d9c132f45d6dcf199bdddb0bd1b1b106e57228d8aaefb8dcb06f8c19394994ad6be6bf67836eb780190e5f13587f6
SSDEEP

96:ed250Tya1GKnsqLL5Zv+v7CTh5WTJTQmK9EfadOF/vDSulYjsoZ/FFZ5rV+fkCVH:5JKnsqfACTSJeRoF3OulYJJ+fkCV9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
62ec7534d512ba26b73037448b248100_JaffaCakes118

Files

62ec7534d512ba26b73037448b248100_JaffaCakes118
.exe windows:4 windows x86 arch:x86

536dca3dbd2e52d5cc21d1e5a28fb92e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
DuplicateHandle
GetCurrentProcess
ExitProcess
Sleep
DeleteFileA
CloseHandle
WaitForSingleObject
CreateProcessA
GetThreadContext
lstrlenW
GetModuleHandleA
HeapFree
GetProcessHeap
InterlockedDecrement
HeapAlloc
GetStringTypeExA
GetThreadLocale
VirtualProtectEx
WriteProcessMemory
FlushInstructionCache
SetThreadContext
InterlockedIncrement
ResumeThread

advapi32

RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

user32

LoadStringA
CharNextA
wvsprintfA

shlwapi

UrlEscapeA

ole32

CoCreateGuid

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 353B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE