bd6348ca16847271e6c88a442a717ef6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bd6348ca16847271e6c88a442a717ef6_JaffaCakes118
Size

7KB
MD5

bd6348ca16847271e6c88a442a717ef6
SHA1

bdc83e94eba4c510a0b989cfdbfe3f5911571cc7
SHA256

40c5703304f392844c29048ceed7d49306b651771538aa8b3d55b658740c2b04
SHA512

415edef63c27d11599d8835b85425a3dec9713eb15c26e88bcd6d70071b07137d1bb91ad54339ed3b714540f2b1935641110eb880f8f2b56267680fe827b82e6
SSDEEP

96:0jmHmgVAUsItJE/Cr+wUEjbqMlrVUiLnJN6vjlnA4Wv6MN:cmHmgVVJE/CFV9LnJUv5A4Wv6q

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd6348ca16847271e6c88a442a717ef6_JaffaCakes118

Files

bd6348ca16847271e6c88a442a717ef6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

77bb3ff2d00948f05d9d90e6c5ccf3ad

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCreateKeyExA
RegSetValueExA

kernel32

AddAtomA
CloseHandle
CopyFileA
CreateMutexA
ExitProcess
FindAtomA
GetAtomNameA
GetLastError
OpenProcess
ReadProcessMemory
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
printf
signal
strcpy
strlen

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 400B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 192B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE