abefa7545ab25dd870bd05296330d1fa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

abefa7545ab25dd870bd05296330d1fa_JaffaCakes118
Size

26KB
MD5

abefa7545ab25dd870bd05296330d1fa
SHA1

679b5d2c2d60abfa224426357b86c4f6e50f34de
SHA256

9c1be532b079aa99b6b8d759e4ac867827e18825a660010b3c48cb2020776d02
SHA512

6ec2704ababdd9743151f57833cc83ab3b3d3f041cacf1e67f3239ace18e70a2f7becf2f40e6a325b35f081d9d5e8f8a1e531662432c5f2e54179eea086ab833
SSDEEP

768:Lk4BOuAmyrVktdKyZ9Gd125Bu+qz+K+U+F7UEE9FQhVBR2:YnuAmyrVktdKy9GdYOL4U+B

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abefa7545ab25dd870bd05296330d1fa_JaffaCakes118

Files

abefa7545ab25dd870bd05296330d1fa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0131f5177432b6877aafdf10c6ce3dc4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

SendMessageA
FindWindowA
wsprintfA

kernel32

DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
GetCurrentProcess
GetLogicalDrives
GetModuleFileNameA
CreateThread
GetTempPathA
GetTickCount
LoadResource
CreateFileA
RtlZeroMemory
SizeofResource
Sleep
WaitForMultipleObjects
WriteFile
lstrcatA
lstrcpyA
lstrlenA
CloseHandle
GetModuleHandleA
LockResource

shell32

ShellExecuteA

advapi32

RegOpenKeyA
RegCloseKey
RegQueryValueExA
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges

shlwapi

StrStrA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ