963b37b4582bc3f36021b801338a8363_JaffaCakes118 | Triage

Sharing

General

Target

963b37b4582bc3f36021b801338a8363_JaffaCakes118
Size

14KB
MD5

963b37b4582bc3f36021b801338a8363
SHA1

285000b5160ba424e8f084c37a7df99f6e9833a1
SHA256

06fc1779292668a9d5aa606e5d3c06390bbbffccf24023be28a522e182ccf36a
SHA512

63134930f805f80af94cf8220d609359c0ab6fa015ad1370eb32c2936fa8ba40c5aed253d788d961c945423ac64521249835f43f12100b78038ba0b059cb54f4
SSDEEP

384:+7Jn8r3JUv0YLq14ukfaX1tJNNnU/s7U4:QJn6ZUv0RkSX1b+WL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
963b37b4582bc3f36021b801338a8363_JaffaCakes118

Files

963b37b4582bc3f36021b801338a8363_JaffaCakes118
.exe windows:4 windows x86 arch:x86

50003ea98908603463dc808dd7148e0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrA

kernel32

CreateDirectoryA
GetCommandLineA
Process32First
CreateToolhelp32Snapshot
ExitProcess
GetProcAddress
LoadLibraryA
WideCharToMultiByte
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetFileAttributesA
TerminateProcess
Sleep
GetCurrentProcessId
GetLastError
Process32Next
GetStartupInfoA
GetModuleHandleA
HeapFree
GetProcessHeap
HeapAlloc

shell32

ShellExecuteExA

user32

wvsprintfA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE