b20101517b8a945fe96dfabcbad06504_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b20101517b8a945fe96dfabcbad06504_JaffaCakes118
Size

373KB
MD5

b20101517b8a945fe96dfabcbad06504
SHA1

c5ba0b5d494142800a2e1c892d04eb6a3f6266a8
SHA256

ddf680fada0c2ca52f0a390f9673bb51f964d5dc2cf3bce3d30ad00535597af5
SHA512

321bebe8c26bbcefc3623885aaee3140ddb1c292b68599cba8e25994e8a66a291c273cdefcdd4041038e4c06ae16005c35a268850dee04c793d463878c56c1dc
SSDEEP

6144:Rq0M8OQAO5WSocVxgGcj/tKzLkcYuNzCWU7sFbJRvUww:A0IEScVfYoo1u5CW1Zrw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b20101517b8a945fe96dfabcbad06504_JaffaCakes118

Files

b20101517b8a945fe96dfabcbad06504_JaffaCakes118
.exe windows:4 windows x86 arch:x86

68cd92e50c3b167b3e5502eee14ce999

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetDoubleClickTime

shell32

SHGetSpecialFolderPathA
ShellExecuteA

shlwapi

StrStrA
StrChrIA

kernel32

GetModuleHandleA
lstrcpyA
lstrcatA
WriteFile
Sleep
SizeofResource
RtlZeroMemory
LockResource
CloseHandle
CreateFileA
ExitProcess
FindResourceA
FreeLibrary
GetCurrentDirectoryA
GetModuleFileNameA
LoadResource
GetProcAddress
GetTickCount
GetVersion
LoadLibraryA

urlmon

CoInternetCompareUrl

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 852B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE