8a511bbf45a64a6ee3165c34a443c80f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a511bbf45a64a6ee3165c34a443c80f_JaffaCakes118
Size

6KB
MD5

8a511bbf45a64a6ee3165c34a443c80f
SHA1

c138b561f3d120ec245c1f3c76623845cb148ac8
SHA256

18716f8a7e8c29bda13496189e70b8dd6f321cc22165d4b08c1fc38ddfb9f6f4
SHA512

322d2e64095ff3615abb1297a3a93e98d361b08d560478c9993e8a38e63740898222c1fb7ed34f894f3ad2d32e3b37aa3af5422295ec2498791d6e56e2ea6fd4
SSDEEP

96:RuF/Lhtv6l2+LK7UVJWMqNSb5wA5uLizoDcBHemMHBt:Yk67UVJWMXF95uGAg8Hn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a511bbf45a64a6ee3165c34a443c80f_JaffaCakes118

Files

8a511bbf45a64a6ee3165c34a443c80f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ed4c5aae2efff3ce4cb448d02ccd29f4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord825
ord389
ord5207
ord5356
ord1988
ord690
ord823

msvcrt

atol
strcat
__CxxFrameHandler
memset
strcpy
strlen

kernel32

LocalFree
TerminateProcess
OpenProcess
GetCurrentProcessId
Sleep
CreateProcessA
CreateThread
GetSystemDirectoryA
CloseHandle
WriteFile
CreateFileA
lstrlenA
WriteProcessMemory

user32

FindWindowA
ShowWindow
GetWindowThreadProcessId
PostMessageA
FindWindowExA

advapi32

RegOpenKeyA
SetNamedSecurityInfoA
SetEntriesInAclA
BuildExplicitAccessWithNameA
RegCloseKey
RegSetValueExA
GetUserNameA
GetNamedSecurityInfoA
RegDeleteKeyA
RegCreateKeyExA

shell32

SHGetFolderPathA

wininet

InternetReadFile
HttpQueryInfoA
InternetOpenUrlA
InternetOpenA
DeleteUrlCacheEntry
InternetCloseHandle

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE