a6ff897824588456907383324750558e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a6ff897824588456907383324750558e_JaffaCakes118
Size

56KB
MD5

a6ff897824588456907383324750558e
SHA1

fcd341e697e709441c0187434b9a1d0b1424fe2a
SHA256

7a05d418fe25d4da88960e311bc8ca95ffc1c23ca44b25232d41ede7f754b93b
SHA512

363a6b59fcb5ec880a50600e7dfb6ea3240fee834f07a941fd185ca69110a04d563245126d8251c8e09754deb7bb42e29097df97495084a768e0e5b2237870e0
SSDEEP

1536:X8vfIb0r7fg6x5bZ7pA0FdZ8zmJrlPsPt8j62V+p8yK:XUIb0rjgGlFdZ8z2JsPSbUS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a6ff897824588456907383324750558e_JaffaCakes118

Files

a6ff897824588456907383324750558e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5e83cb57ee17525dd3e8c263268c5821

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr71

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__getmainargs
_except_handler3
__dllonexit
_onexit
_controlfp
_amsg_exit
_acmdln
exit
_cexit
_ismbblead
_XcptFilter
_exit
_c_exit
strstr
free
sprintf
calloc
fopen
fclose
fwrite
__set_app_type
malloc

kernel32

lstrcatA
IsDebuggerPresent
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32First
Process32Next
GetModuleHandleA
GetCurrentProcess
ReadProcessMemory
CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
GetStartupInfoA

advapi32

RegSetValueExA
RegCloseKey
RegCreateKeyExA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE