b2975c0e0b7aad0ce3bfd22a2c6da1e8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b2975c0e0b7aad0ce3bfd22a2c6da1e8_JaffaCakes118
Size

8KB
MD5

b2975c0e0b7aad0ce3bfd22a2c6da1e8
SHA1

fbe892610de9a769fe0562f5d07793c382fbd132
SHA256

182b60f3e4ce56a1261d753227bc180aa3b307ebe5fedcac77994ca71e991b48
SHA512

32fac21e84f2f4fbd05204d709ec046d43d9f2bb7387f7eac80979b523a243646f7ede755cb8713f5e4e29d291ebe5f1949ff502d958055a1dae1b046f7d57fb
SSDEEP

192:PWMkmZ/vGNK1Dd77znJCBQcQ33M79ZRKDe:uMkmxO8J77z8Qc2M7dKDe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2975c0e0b7aad0ce3bfd22a2c6da1e8_JaffaCakes118

Files

b2975c0e0b7aad0ce3bfd22a2c6da1e8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

434bf05660275c13ed73252b3bc18035

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

CreateProcessA
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetFileSize
LoadResource
MapViewOfFile
ReadFile
ReadProcessMemory
ResumeThread
RtlMoveMemory
SetEnvironmentVariableA
SizeofResource
Sleep
CreateFileMappingA
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
WinExec
WriteProcessMemory
lstrcatA
lstrcmpiA
lstrcpyA
FindClose
FindFirstFileA
FlushFileBuffers
WriteFile
GetModuleFileNameA
GetModuleHandleA
SetCurrentDirectoryA
lstrlenA
CreateFileA
CloseHandle
TerminateProcess

advapi32

RegQueryValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ