b5226c4b895a30ca868a86fe18bd4f25_JaffaCakes118 | Triage

Sharing

General

Target

b5226c4b895a30ca868a86fe18bd4f25_JaffaCakes118
Size

97KB
MD5

b5226c4b895a30ca868a86fe18bd4f25
SHA1

ebae4f012c5ae54b5c0b85b24755b9443e507547
SHA256

d0c606e38d0726af1ac1563f1a774ab40abea4a2ecde898c15c2e4723afdee5b
SHA512

411c7223139a59f76fa4cd2de7b9367433ce8b8c55df3d66751390521b97be4fbfba1de41324e88a5baf2a58c33701a0fad241a49b08e189e45be2101971d481
SSDEEP

1536:idM1fuRctiBDrL6Ereck26lGORM82crLr+BSBSSqSpYrj:idMFCfBD6ErfkSORiQP+BS7Yrj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5226c4b895a30ca868a86fe18bd4f25_JaffaCakes118

Files

b5226c4b895a30ca868a86fe18bd4f25_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7d9856d013d3ce5aca8b13b6ca8e8cb8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetModuleFileNameA
GetTempPathA
CloseHandle
CreateFileA
GetVersionExA
Sleep
GetStartupInfoA
GetModuleHandleA

user32

ShowWindow
TranslateMessage
DefWindowProcA
RegisterClassExA
DispatchMessageA
CreateWindowExA
GetMessageA
PostQuitMessage

shell32

StrStrA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
srand
time
rand
fclose
sprintf
fwrite
fopen
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_strlwr

urlmon

URLDownloadToFileA

shlwapi

SHGetValueA
SHSetValueA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

cdata
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ