659dde290365216f430ad5a8ea28a025_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

659dde290365216f430ad5a8ea28a025_JaffaCakes118
Size

38KB
MD5

659dde290365216f430ad5a8ea28a025
SHA1

4fbed3d34c7a8ff9d636b33471703d028ffdf813
SHA256

a3e65e6ca38106436f7fe047538bbc224ea8c3b162c0685d11659877afd9e3f0
SHA512

25203ccd5eda0ff602de55d26288963a2bd6169e3e08eca25627b51f0164f7e137775a517d4015f6fdae595649163d6ee1a6559e83898ae45b921bcde9c45ed9
SSDEEP

768:wQh5V+cdPhJhX5IpPa65hMT8R+Wp/+I4YCTjJe:wQjAcd51XXBjJe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
659dde290365216f430ad5a8ea28a025_JaffaCakes118

Files

659dde290365216f430ad5a8ea28a025_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7828d59efe9e84a1fc639c916a1e091e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

imagehlp

CheckSumMappedFile

kernel32

GetCurrentProcessId
VirtualFree
GetTempPathA
CloseHandle
WriteFile
CreateFileA
VirtualAlloc
ExitProcess
LoadLibraryA
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
Sleep
QueryPerformanceCounter
ReadFile
SetFilePointer
GetProcAddress
FreeLibrary
GetVersion

advapi32

RegCreateKeyW
RegSetValueExA
RegDeleteKeyA
RegSetValueExW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 162B - Virtual size: 310B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ