862722988a9c8fd2abad55d0711bc5fb_JaffaCakes118 | Triage

Sharing

General

Target

862722988a9c8fd2abad55d0711bc5fb_JaffaCakes118
Size

14KB
MD5

862722988a9c8fd2abad55d0711bc5fb
SHA1

09e370fbbac7f3a96af71991554347eba1b2db55
SHA256

4cf47c94089e1c4f457860799b0af3d4f8dc5f6ddd8f390eb9b16fa3a4ca67a2
SHA512

d71ed6c0d23ebfc1fd7eb385da8d115158d006565110bc284a53b84221a8e16c7459e6280a176ce391b14f5dd3d515f1543cd0cc936bfd52f464d56ece4e06c6
SSDEEP

192:ywHZ1ZFt6FHR0qhAh0LLpXYIDoLTnyTno4mo/MgW4:T2HRn6m8TyToVoUp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
862722988a9c8fd2abad55d0711bc5fb_JaffaCakes118

Files

862722988a9c8fd2abad55d0711bc5fb_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c692dfbdb4c3fb518719d5761eddf6d8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
GetTickCount
WriteFile
OpenProcess
Sleep
SizeofResource
TerminateProcess
ReadFile
lstrlenA
VirtualAlloc
GetModuleFileNameA
GetModuleHandleA
WinExec
CloseHandle
DeleteFileA
SetFilePointer
FindResourceA
GetFileSize
lstrcatA
CreateFileA

advapi32

RegOpenKeyA
RegQueryValueA
RegCloseKey

msvcrt

strstr
memcpy
memset

psapi

EnumProcesses
GetModuleFileNameExA

user32

wsprintfA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ