ac836489e296c8060361ec979cfb10b9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ac836489e296c8060361ec979cfb10b9_JaffaCakes118
Size

17KB
MD5

ac836489e296c8060361ec979cfb10b9
SHA1

6af3ef66b346dbbe8b35ca62d25f607873bf44cf
SHA256

a2a9d84bbbc6fe17eec7748ded83cdd839634b69124c059a0cc96521aa8fe2b7
SHA512

fe01bea921d81ef27284dc982f780bb084eb91968d7a1ac0d8de287e97ecf2b575a48f3697fdb424d614f5ee216f8099696e768b337764239d52eca4a3685301
SSDEEP

384:WbfErl16nwJWuLJGS/DR+dyYp+iF6tp4LP:WbEr76nwJr8kRkhmp+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac836489e296c8060361ec979cfb10b9_JaffaCakes118

Files

ac836489e296c8060361ec979cfb10b9_JaffaCakes118
.exe .url windows:4 windows x86 arch:x86 polyglot

ea1fa0beb5dcc67e4c62d1e1d105716c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineA
lstrcatA
CopyFileA
lstrcpyA
MultiByteToWideChar
lstrlenA
GetStartupInfoA
GetModuleHandleA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA

ole32

CoCreateInstance
CoUninitialize
CoInitialize

msvcrt

_EH_prolog
__setusermatherr
fclose
fprintf
fopen
__CxxFrameHandler
__p__commode
sprintf
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
_adjust_fdiv
_controlfp
__p__fmode
__set_app_type
_except_handler3

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE