ba8f709b8ec74215465efca246758d12_JaffaCakes118 | Triage

Sharing

General

Target

ba8f709b8ec74215465efca246758d12_JaffaCakes118
Size

8KB
MD5

ba8f709b8ec74215465efca246758d12
SHA1

c83a2ce7fc39ee280e9e9fee2a1ae38a02f2f78e
SHA256

bd27ec2f6ba03b0f32ade8facfd07f1f0c9a6bf020ec08682d8c447745ff49b2
SHA512

c8ebb2187c8891ea22851ef5cf56529171f7485794561207b9b9db7f84e45fc819dcaceab7c3fb2cdd969ff55e6db2627979d96b51307897726aaf6e930b152a
SSDEEP

192:kLwuwsGjnpno1SYYStPBAgmsDpQM9oLBO5Yc:2VGbpo1SYYs6M6O5Yc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba8f709b8ec74215465efca246758d12_JaffaCakes118

Files

ba8f709b8ec74215465efca246758d12_JaffaCakes118
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE