b28970ebf559926c840ec05003a7e282_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b28970ebf559926c840ec05003a7e282_JaffaCakes118
Size

7KB
MD5

b28970ebf559926c840ec05003a7e282
SHA1

975483ee9bcc2ae5c95b86ebb107fb8bd92aa8e0
SHA256

f1a7c3f1a594dc785ef5d717dcb289b5815c543d783521efac370f61387ecf1b
SHA512

ea31291ff96c86daef8e1dd97efe3515986ff3ed9b7e038f6efa5163581747c6bf22e9fd90dc8364f9b3920be13ab0b329d80f9fa5739a26a5c92f3bd384b38c
SSDEEP

192:akmlc9TS/LbRtELmRKRHGjjUMyi8M1DGQoF/Kwg8:a7qYhYiwT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b28970ebf559926c840ec05003a7e282_JaffaCakes118

Files

b28970ebf559926c840ec05003a7e282_JaffaCakes118
.exe windows:4 windows x86 arch:x86

b873a0ea610a8c9589b8dc30b8a7ba6b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
OpenEventW
SetFileAttributesA
GetProcAddress
PulseEvent
SetEvent
lstrcatA
CreateEventA
WideCharToMultiByte
lstrcatW
lstrcpyW
GetCurrentProcessId
CompareStringA
WaitForSingleObject
GetSystemDirectoryA
CloseHandle
ExitProcess
GetCommandLineA
CreateThread
ExitThread
CreateProcessA
Process32Next
Process32First
CreateToolhelp32Snapshot

user32

ShowWindowAsync
wsprintfA
DestroyWindow
CloseWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
PeekMessageA
CreateWindowExA

advapi32

RegCreateKeyW
RegOpenKeyW

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE