82d9910351be467e917ef9c2519a57ba_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

82d9910351be467e917ef9c2519a57ba_JaffaCakes118
Size

4KB
MD5

82d9910351be467e917ef9c2519a57ba
SHA1

4a73c603a34f3fec0b36b0c2360bbc3c5634dfb3
SHA256

c7204a07c9b1dde9062b4c0d9ac6a52a167d751a3b4d4a83acc0d138ec26de25
SHA512

8e681efd72e238b4687ed47c66691e1acdb9e6510141d04152a04a4f0f76f170d39b8b57873a70ea9be4a97b60356f91dbabbd078553c91029a6bbef3b8e1fd2
SSDEEP

96:yZjptJ/W/pia7TZ9LWfBHLPmnwFZDIopM:ujptJ/W/Ia7TZ9LmrmoD7M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82d9910351be467e917ef9c2519a57ba_JaffaCakes118

Files

82d9910351be467e917ef9c2519a57ba_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1ed264f434b6241265cdc707ff6b4710

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
CreateFileA
FindResourceA
FreeResource
LoadResource
WaitForSingleObject
GetTickCount
WriteFile
Sleep
SizeofResource
CreateProcessA
GetTempFileNameA
LockResource
GetModuleHandleA
CloseHandle
GetTempPathA

shell32

SHFileOperationA

shlwapi

StrRChrA

msvcrt

memcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
malloc
free

Sections

pe
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ