8e36286b6457146833007443a4189ad3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e36286b6457146833007443a4189ad3_JaffaCakes118
Size

19KB
MD5

8e36286b6457146833007443a4189ad3
SHA1

512749b391f0a134844453c0db6144a3539d4adf
SHA256

ff1584302a785ce6440a49b3b56c293b74a6c73ab6ab91027e019abda2bf29a4
SHA512

78cfabcdffe07f6c21f172bb6256ca1ece6367f06fd12aacd4b585b6c515adf8e35ed6b4b8dd1b8a3b190e4c3a9b177fd024174b4a68b77cc033e9b3e857da34
SSDEEP

384:o3NtnjbaGccMG2BfQ7DV16/Qw4FbBgJYDj:MNtj+GcVGIQ7D76/qbsY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e36286b6457146833007443a4189ad3_JaffaCakes118

Files

8e36286b6457146833007443a4189ad3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

62156ce2bf2f3a6d41572dd5187bbaf7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
LoadResource
LockResource
CreateFileA
SizeofResource
WaitForSingleObject
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpiA
SetLastError
GetCurrentProcessId
VirtualFree
VirtualAlloc
CopyFileA
CompareStringA
OpenProcess
CloseHandle
GetPriorityClass
ResumeThread
CreateRemoteThread

user32

FindWindowA
wsprintfA
GetWindowThreadProcessId

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteA

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE