bab9b663bdaf4ff26817d431bf23725f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

bab9b663bdaf4ff26817d431bf23725f_JaffaCakes118
Size

53KB
MD5

bab9b663bdaf4ff26817d431bf23725f
SHA1

7dc6f7763c8f2c617d4cfe07016879d780a9c1b6
SHA256

64e0552b310cd9737dd8b44149328b0f28b3a0fd6520b6f180154ff51e315545
SHA512

f8265b3c5a7ca2c27c5800435da460641e13dc6b71580f9844bdbbd88186cabeb42f3b896f9bc335c0647874153f2963a26032c167bf32ab82d2d29c68b3f7c6
SSDEEP

1536:7EHOZqzS/1sZsCVDzCPY+I1UFMbUujL2:Y41LUUY+IwS2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bab9b663bdaf4ff26817d431bf23725f_JaffaCakes118

Files

bab9b663bdaf4ff26817d431bf23725f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ec859c1b839fb815cabc4ccd75791ff5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey

kernel32

CloseHandle
CopyFileA
CreateFileA
DeleteFileA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetWindowsDirectoryA
LoadResource
LockResource
OpenProcess
ReadFile
SizeofResource
Sleep
WaitForSingleObject
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpiA
SetLastError
CreateRemoteThread
ReadProcessMemory
GetCurrentProcessId
ResumeThread
VirtualFree
VirtualAlloc

user32

GetWindowThreadProcessId
FindWindowA

shell32

ShellExecuteA

Sections

.text
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE