a189efaf32c0814e6089d5eab3c05d5b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a189efaf32c0814e6089d5eab3c05d5b_JaffaCakes118
Size

42KB
MD5

a189efaf32c0814e6089d5eab3c05d5b
SHA1

027fca4731058be2511168598bb9eda9607f2c46
SHA256

0268c9e12659d6b123d3ce32b0d38e32b6e00cc715c5e4d45b7ad8717aac907b
SHA512

43ceff40a6f86c957d6801d2a30b52bc4913940ebe69b3fea13a8c7eafca061b998bfc99b04ecf7d58493f6ed71a353e07e07456804018c6fc07f48a741b8603
SSDEEP

768:e4IedHho4pSiL8K8oD3L/72TcSTtcf4B1Ho9IY:e4Iedho4jQKetcOB+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a189efaf32c0814e6089d5eab3c05d5b_JaffaCakes118

Files

a189efaf32c0814e6089d5eab3c05d5b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

132f1bb38621ebfba61e550992e3abfd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
HeapAlloc
HeapFree
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
WriteFile
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

advapi32

RegOpenKeyA

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE