ade3f84e4862b68843e3df1ec0ffe73b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ade3f84e4862b68843e3df1ec0ffe73b_JaffaCakes118
Size

24KB
MD5

ade3f84e4862b68843e3df1ec0ffe73b
SHA1

08236178a7f65b76365b38b16c93fdb643b078c8
SHA256

531a9157f2af448246a5bb13801bae49996de63003a9a4dda6f44e9375e1c3f0
SHA512

1fda5c26f8121e399f4dfc31188a60a7f37eab4eba7199959331ef3f6b17b9ef5932e3f211fde76226c7c78c17797d2cc1dbb81695189fb27fcf59f807e2ebd9
SSDEEP

768:nNUHaF5bhLLLMLL2LL2LLesFVVXj3akQ:GHitUV9mk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ade3f84e4862b68843e3df1ec0ffe73b_JaffaCakes118

Files

ade3f84e4862b68843e3df1ec0ffe73b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ebb65c9ffa1031b0826eb8543877eed6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFilePointer
GetFileSize
CreateFileW
CreateDirectoryW
GetSystemDirectoryW
FindClose
FindNextFileW
FindFirstFileW
ReadFile
FreeResource
GetProcAddress
LoadLibraryW
FindResourceW
GetModuleHandleW
FreeLibrary
WriteFile
Sleep
CloseHandle
SizeofResource
GetModuleFileNameW
GetStartupInfoW

advapi32

RegSetValueExW
RegCloseKey

msvcrt

wcsstr
wcscat
wcslen
??3@YAXPAX@Z
wcsncmp
wcsncat
wcsncpy
??2@YAPAXI@Z
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
wcscpy

Sections

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ