aba14d29cce64226733592b3dd506e0c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aba14d29cce64226733592b3dd506e0c_JaffaCakes118
Size

16KB
MD5

aba14d29cce64226733592b3dd506e0c
SHA1

31910d276fb2c49f475845489f2f0905b3881924
SHA256

aa2f43d8fe70d57894eebb7201cd94a8dc9481cacfa18a56da26673f2505f24a
SHA512

100bb4c6280b70c179361b380843002f7d5d9050a8079c90eb31a437c015ca18491f691cd2d01eba90e60d889275e4b9158a43a5317d6900523c2b00222209f5
SSDEEP

192:sT7Jn8rKKWD+tDQFvM4hDY8F5ZDeZj2R3UejKzELJ3kFBGPEFsVVpfP7UX/U:sT7Jn8r3JyvM25ZDtR/S20mn3F7UXc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aba14d29cce64226733592b3dd506e0c_JaffaCakes118

Files

aba14d29cce64226733592b3dd506e0c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

50003ea98908603463dc808dd7148e0f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrStrA

kernel32

CreateDirectoryA
GetCommandLineA
Process32First
CreateToolhelp32Snapshot
ExitProcess
GetProcAddress
LoadLibraryA
WideCharToMultiByte
CloseHandle
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetFileAttributesA
TerminateProcess
Sleep
GetCurrentProcessId
GetLastError
Process32Next
GetStartupInfoA
GetModuleHandleA
HeapFree
GetProcessHeap
HeapAlloc

shell32

ShellExecuteExA

user32

wvsprintfA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE