8b045be9a7fb3570e54c13005982aab9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8b045be9a7fb3570e54c13005982aab9_JaffaCakes118
Size

184KB
MD5

8b045be9a7fb3570e54c13005982aab9
SHA1

03b1fdd6b9fcd62b56569bc2227012545bb1c964
SHA256

1b999d79d7adee85986eb5222fcb5ae0811c6d964511dd86ec5ad63555e87ca1
SHA512

77607b4efcbb44b04a3ddd4b94137ef2c9db7190e0b7fd2a09175fb2deaf89d75748730741ab8b0ec7e3757a35a5a83abd546f7eae705d86e326d061597cb9af
SSDEEP

3072:MEit9JOwWW8jAJKHc7LisTRMNQP59js/+BC3K5eqT:M1WDwKHc728ReK7T

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b045be9a7fb3570e54c13005982aab9_JaffaCakes118

Files

8b045be9a7fb3570e54c13005982aab9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aaa4c9b5cced5e86199c0db047e7ac52

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetModuleFileNameA
GetTempPathA
CloseHandle
CreateFileA
Sleep
GetStartupInfoA
GetModuleHandleA

user32

ShowWindow
TranslateMessage
DefWindowProcA
RegisterClassExA
DispatchMessageA
CreateWindowExA
GetMessageA
PostQuitMessage

shell32

StrStrA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
srand
time
rand
fclose
sprintf
fwrite
fopen
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_strlwr

urlmon

URLDownloadToFileA

shlwapi

SHGetValueA
SHSetValueA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ