8c14d0aeda0c4fce1316cff9a17d4674_JaffaCakes118 | Triage

Sharing

General

Target

8c14d0aeda0c4fce1316cff9a17d4674_JaffaCakes118
Size

6KB
MD5

8c14d0aeda0c4fce1316cff9a17d4674
SHA1

dce23115096e4572330e4685d7f3236e25d3ce74
SHA256

c283b9dc6389c2395d0435cce448167c04c252bc1b2870042d3db511af456b7f
SHA512

dc339388bf0c7b910b0f4375329f578753dbf9d1df0da8cb86170ef909ddfbbb77a75164a43f14fad7d17a9876ca976cd857b39d8d8a2ceaecc4954e497ed748
SSDEEP

96:GhM/6IeIXg5TFT2LT/bGgwKBn+uB3Pk8L8Kz8tk3Kaz1TGphLuall8SzgTd8khKI:aMCIeIwRl2f/5wKB+uRPZIKzMk3KiOhG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c14d0aeda0c4fce1316cff9a17d4674_JaffaCakes118

Files

8c14d0aeda0c4fce1316cff9a17d4674_JaffaCakes118
.exe windows:4 windows x86 arch:x86

3a52d2693dd6f8df968388a96deb7910

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
WideCharToMultiByte
lstrcpyA
lstrcatA
CreateEventA
HeapAlloc
GetProcessHeap
HeapFree
Sleep
ExitProcess
WaitForSingleObject
GetCommandLineA
SetEvent
CreateThread
CreateProcessA
ExitThread
CompareStringA
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
GetFileAttributesW
SetFileAttributesW
WinExec
GetModuleHandleA
SetFileAttributesA

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

user32

CreateWindowExA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects
DestroyWindow
PeekMessageA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE