8350f296e783e1d27839c848b14696d4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8350f296e783e1d27839c848b14696d4_JaffaCakes118
Size

58KB
MD5

8350f296e783e1d27839c848b14696d4
SHA1

d086e564d847e213ce07a95d3101736262bca7f7
SHA256

f7f8a33eb0ded23cb4c6fa24727b64afe2e8f0e5dcb1273d3b81fe1ebfbce537
SHA512

fdee0f5595377ebbe35eb0d19530823fc1994f990c929d2f422b648fae8f2d9ce0c25d34e88557a3698ee3f4f5e0332540ff2038284972daeba908bd5d35576c
SSDEEP

768:BlwtAJZ0VelydmU+JmrjvmVAfbciE/4uJusqS/avF5PmnekCcQc9S:Bk/EyTgAfYj/4uJoJF9mngcQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8350f296e783e1d27839c848b14696d4_JaffaCakes118

Files

8350f296e783e1d27839c848b14696d4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1aad4f8865e5a2850f75bb59bd537f75

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
lstrcmpA
GetModuleFileNameA
GetStartupInfoA

advapi32

RegOpenKeyExA

msvcrt

fread
ftell
fseek
fopen
strcat
strcpy
calloc
_exit
fclose
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_stricmp

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 730B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ