b75e4199b587d83c2a13f090f89323ab_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b75e4199b587d83c2a13f090f89323ab_JaffaCakes118
Size

9KB
MD5

b75e4199b587d83c2a13f090f89323ab
SHA1

7f003a4c6b6868c9729af6c2338484b77a7eb66a
SHA256

0921a68381339101e8773ba8ffed39ab281388b46d48b9ff90545c5ad2a1ba7d
SHA512

323936f8c5a049afc194230461783d51b1bcdf464c98e239d09093ad2cfd49080208cfdcc9f8d61b6342b0c60f38d21e787e935791261ee77792e9175876a169
SSDEEP

192:qThbeYHFZrsANc3ZF+JHlp1eJEEZuMJd/8+4gwB67lR:qtbeYP/cpF+RlAE2uMP/8g667l

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b75e4199b587d83c2a13f090f89323ab_JaffaCakes118

Files

b75e4199b587d83c2a13f090f89323ab_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7e04a6da7ed54750de120428ffd3df91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetCurrentThreadId
GetTickCount
GetTempPathA
lstrcatA
CopyFileA
GetSystemDirectoryA
lstrcpyA
CreateThread
GetDriveTypeA
CreateDirectoryA
GetModuleFileNameA
CreateProcessA
VirtualProtectEx
GetCurrentProcess
GetLastError
CreateMutexA
GetCommandLineA
DeleteFileA
LoadLibraryA
GetProcAddress
Sleep
GetVolumeInformationA
GetPrivateProfileStringA
lstrlenA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA

msvcrt

fopen
sprintf
malloc
strstr
_strlwr
fclose

Sections

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE