674f3fd74539a895de04fd9a391236de_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

674f3fd74539a895de04fd9a391236de_JaffaCakes118
Size

142KB
MD5

674f3fd74539a895de04fd9a391236de
SHA1

5395b7b46c9180bc4c21916fdb22b99c30bf5fed
SHA256

380e6c614746f36d87fc57428e272847918fcb560a8b79c349448c9652beb213
SHA512

26b0a6d04b9774d136839f0b3afd5ffa71cbf2ed951d456085b55443cb3cda0258fb84981a58fc0348a282aba8a58c705dd98c36d5d0aa6ec67e72cd6c59ea9c
SSDEEP

3072:fdglCyVj913K+lGR8NGvuGqO678kq3DdgHT/krG61lbf9Xej:lOb13KGVOqO67OgH4r/rrsj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
674f3fd74539a895de04fd9a391236de_JaffaCakes118

Files

674f3fd74539a895de04fd9a391236de_JaffaCakes118
.exe windows:4 windows x86 arch:x86

15f5480616f574fddda4464fdbaf239d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
LoadLibraryW
SizeofResource
CreateFileW
FlushFileBuffers
GetProcAddress
LockResource
LoadResource
GetCurrentThreadId
CloseHandle
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeLibrary
FindResourceW
FreeResource
GetModuleFileNameA
ExitProcess
GetCurrentProcess
TerminateProcess

user32

GetMessageW
GetInputState
PostThreadMessageW

advapi32

RegCloseKey
RegOpenKeyW
RegCreateKeyExW
RegSetValueExW

shell32

ShellExecuteW

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ