a06e1a67d7cc30ca492cf60ba82ef81f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a06e1a67d7cc30ca492cf60ba82ef81f_JaffaCakes118
Size

13KB
MD5

a06e1a67d7cc30ca492cf60ba82ef81f
SHA1

79b45dd5bb1d8f681daf1657f36bc2268b97d249
SHA256

77795365c45dd37eba3cb1255f109e759596707b861951a28c886faafa410354
SHA512

0f5ca8619d1e02f0e936d5c2e522a32e009b642c0d7f84377beec63829fcef36b1d27bbbb96f4ab64ded0674cc343579236fcd0aa0e0d8af203855dc4e45a1fe
SSDEEP

192:duWqVl6WwfHz2oBKORbhPWXMa5+ZqlGRVFJc6SriyDU:EWq36WUHz2oBKORVWt5+ElGR7JXyo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a06e1a67d7cc30ca492cf60ba82ef81f_JaffaCakes118

Files

a06e1a67d7cc30ca492cf60ba82ef81f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

65fc10eb527065189acdaae40fca6a48

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadResource
SizeofResource
FindResourceA
lstrlenA
CreateProcessA
CreateRemoteThread
GetProcAddress
GetModuleHandleA
CreateFileA
VirtualAllocEx
GetLastError
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
LockResource
WriteFile
CopyFileA
CloseHandle
GetModuleFileNameA
GetSystemDirectoryA
lstrcatA
WriteProcessMemory

user32

MessageBoxA

advapi32

RegCloseKey
AdjustTokenPrivileges
RegCreateKeyA
RegSetValueA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA

msvcrt

memcmp
strcat
strlen
fwrite
printf
memcpy
strcpy
free
strtok
strncpy
_strnicmp
fclose
fread
fseek
fopen
memset
??2@YAPAXI@Z
fprintf
_iob

Sections

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ