898e8c400b50770ba44bfcf0e4c04624_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

898e8c400b50770ba44bfcf0e4c04624_JaffaCakes118
Size

17KB
MD5

898e8c400b50770ba44bfcf0e4c04624
SHA1

e5485e7ce3ff82fef1be2456b45a3f3cbd859b7f
SHA256

b0619d1890d2caa7f340086c5608aeba329d665494d0adf40f9f2683951ef68b
SHA512

36b5cc0ff6a8f00c39b2a4bfc0329ab87ddf19e3780ac161a678bb2525b24b92953551c65b098407a4530a90adcbd2a2c65a33fae71019401d6d57d1742894c2
SSDEEP

384:dMC6O1G8E0i1Mm4y81pg26JKOIatI81w82DZW:dz6T74y+aAfII81Z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
898e8c400b50770ba44bfcf0e4c04624_JaffaCakes118

Files

898e8c400b50770ba44bfcf0e4c04624_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0351bfa1783803a854c50c4a9a4014b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileExA
Sleep
CloseHandle
CreateFileA
lstrcatA
FindResourceA
ReadFile
SetFilePointer
GetFileSize
GetProcAddress
LoadLibraryA
SizeofResource
LockResource
WriteFile
GetFileTime
SetFileTime
lstrcpyA
FreeResource
GetModuleHandleA
GetStartupInfoA

advapi32

RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
RegFlushKey
RegCloseKey
RegCreateKeyExA

msvcrt

strlen
malloc
rand
memcpy
sprintf
strcat
free
atoi
srand
time
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strncat
memset

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ