6955b3a70fd84c69cb7bd270ad02b25a_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6955b3a70fd84c69cb7bd270ad02b25a_JaffaCakes118
Size

12KB
MD5

6955b3a70fd84c69cb7bd270ad02b25a
SHA1

e8a588aebef05247247c1f86739e7d138a695b30
SHA256

a8195701c767aab3a64e034bdc99cf0fa8fe1707afd3a4ba9989dc3aa87abab2
SHA512

4bb538bc987e9bbf6188f7107441ccaf0d6f6e6f071a41394063754a2fcff2e508851d0eb5204a4fcfac6b59e4a77d69b62f30dd4e3a7e9cff13549dc419b518
SSDEEP

192:iyjjPpizYXEHAQGB5rVWCRIcIGKy+kPDY68TVrEiAHGFGEz4QUQ+j3s40MLyEb/v:iyjreHAQKy2Kyxb6I0+/0MLy0v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6955b3a70fd84c69cb7bd270ad02b25a_JaffaCakes118

Files

6955b3a70fd84c69cb7bd270ad02b25a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

53ffaf4b79a417d9c33729a35c90f78a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyA
DeleteFileA
CloseHandle
GetModuleFileNameA
GetProcAddress
lstrcatA
GetFileAttributesA
Sleep
GetModuleHandleW
SetEvent
OpenEventA
ExitProcess
GetModuleHandleA
GetCommandLineA
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
GetTempPathA
Process32First
CompareStringA
OpenProcess
TerminateProcess
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
GetCurrentProcess

user32

CharToOemA
MessageBoxA
ExitWindowsEx
wsprintfA

gdi32

RestoreDC

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyA
RegDeleteValueA
RegOpenKeyExA
LookupPrivilegeValueA
RegDeleteKeyA
RegQueryValueExA
RegSetValueExA
OpenProcessToken

shell32

ShellExecuteA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE