b4d46cd432d251d3528c2b8af8b55ed1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b4d46cd432d251d3528c2b8af8b55ed1_JaffaCakes118
Size

10.4MB
MD5

b4d46cd432d251d3528c2b8af8b55ed1
SHA1

b4804999f14a7565921cf5d078e9b343668a37e0
SHA256

0fb67b310861f4219c944e72cb9568869ee4634e101fddb0a89fe96f7c50cea4
SHA512

1c70937c379a872ff09c7957dafa0fc0539b8d13d53879074c0e2dad7c24c4a4c229fa434c37769fa67dd40593cd84615faeaf86cd78e28b326bfd949d23f102
SSDEEP

196608:DbmA7lDwrMbspUJg7bJriIUhzdGIhTZ8kO9zvGT2ZTO:DamwrMb1g7bUIUhz8ASf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4d46cd432d251d3528c2b8af8b55ed1_JaffaCakes118

NSIS installer 1 IoCs

resource	yara_rule
sample	nsis_installer_2

Files

b4d46cd432d251d3528c2b8af8b55ed1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dc51b173bc1d89af320fdb6dc33042f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA
SHGetSpecialFolderPathA

shlwapi

StrChrIA
StrStrA

kernel32

lstrcpyA
lstrcatA
WriteFile
Sleep
SizeofResource
CloseHandle
CopyFileA
CreateFileA
ExitProcess
FindResourceA
GetCurrentDirectoryA
GetModuleHandleA
GetTickCount
LoadResource
LockResource
RtlZeroMemory

urlmon

CoInternetCompareUrl

comctl32

GetMUILanguage

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 758B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10.4MB - Virtual size: 10.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE