8e452821a7b5701be2d9fc1d95d34113_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8e452821a7b5701be2d9fc1d95d34113_JaffaCakes118
Size

81KB
MD5

8e452821a7b5701be2d9fc1d95d34113
SHA1

1c422f8942c71bf2760cd7ac4f3aa7ff33150987
SHA256

f5ec3b5c52ee813c61b5cffa16f467b812c0bec6da4f30acdff7246ab5df3d2f
SHA512

50f797f8424daedaf6b6b072bb6044f9966a44416e49be617790cc004c98412edcdc3437dd0b5c998c93d955f19d4cdec17e830fcf4455be83f9a1b434cc2b9d
SSDEEP

1536:mbtK65tbVXjYSfUE9AviBNnnIu8sbXzAESLSJV:itK65teSfU/K7nI5sbSGL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e452821a7b5701be2d9fc1d95d34113_JaffaCakes118

Files

8e452821a7b5701be2d9fc1d95d34113_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8c9a5b2787db4a2f8e135f11acd68e98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mini_installer_patch_3stage.pdb

Imports

advapi32

RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

kernel32

HeapAlloc
GetProcessHeap
HeapFree
WideCharToMultiByte
MultiByteToWideChar
ReadFile
WriteFile
CloseHandle
SetFilePointer
CreateFileW
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetProcAddress
LoadLibraryExW
ExpandEnvironmentStringsW
lstrlenW
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
RemoveDirectoryW
DeleteFileW
LocalFree
lstrcmpiW
GetCommandLineW
CreateDirectoryW
GetTickCount
FindClose
FindNextFileW
FindFirstFileW
MoveFileExW
GetLastError
EnumResourceNamesW
GetModuleFileNameW
GetTempPathW
FindFirstFileExW
SetProcessWorkingSetSize
GetCurrentProcess
ExitProcess
GetModuleHandleW
FindResourceW
SizeofResource
LockResource
LoadResource

shell32

CommandLineToArgvW

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ