a060ac78858390959eadc127ebe97ca3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a060ac78858390959eadc127ebe97ca3_JaffaCakes118
Size

14KB
MD5

a060ac78858390959eadc127ebe97ca3
SHA1

1b5befac3c83b6e645e6e9f1c4fcd2dca324b349
SHA256

edddfd68b3be1b1e9a3a4aa79a6f4f83404b781c9aff7d3bfe9c19b1403abcbb
SHA512

14728b8dc4ff61b8a4f988a7ecf45d9aff2cc858071b9aacba0c9ad6766a265116502c099fc7807de3b629fafd7b9ad92a5d58fd042f714770c579e3dfd44818
SSDEEP

384:kYkmLYKAsJ/bLr4VmGlxlTHHggWwPWGoIy6:JYc/bv4xlxlTngc0/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a060ac78858390959eadc127ebe97ca3_JaffaCakes118

Files

a060ac78858390959eadc127ebe97ca3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

c4661c6ce4e43c335e20f9b7d0a9b46b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrA

kernel32

CreateDirectoryA
GetCommandLineA
Process32First
CreateToolhelp32Snapshot
ExitProcess
GetProcAddress
LoadLibraryA
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetFileAttributesA
TerminateProcess
Sleep
GetCurrentProcessId
GetLastError
Process32Next
GetStartupInfoA
GetModuleHandleA
HeapFree
GetProcessHeap
HeapAlloc

shell32

ShellExecuteExA

user32

wvsprintfA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE