be944db9ae70531f641098073eaa12e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

be944db9ae70531f641098073eaa12e4_JaffaCakes118
Size

361KB
MD5

be944db9ae70531f641098073eaa12e4
SHA1

16c20819c9f041421334a1241c64da4aec0755b8
SHA256

216a8bb067169671e99d2effcff42ec0fa7ebe70d3437f72bbb424df8fd13e55
SHA512

a950219d5fb48ca9096fd86c06387e22ca727337c2ae513e80fe1cdd6adb1d7d5a11b133082201df854e8383c21a5171eb4699c524e87be30ffc410084bd4558
SSDEEP

6144:RUO9KvqMBGVIAT6O9Fy8kI68/eZPyHSF9I/9M/q4cNoo+S/RtyW1Opw9:r9KvrEdLyvRnk/9M/qrNooV/REWQpw9

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be944db9ae70531f641098073eaa12e4_JaffaCakes118

Files

be944db9ae70531f641098073eaa12e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7b0061304054d179fe2e82f52b4df34a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FreeResource
GetDriveTypeA
GetFileAttributesA
GetLogicalDrives
GetModuleFileNameA
GetSystemDirectoryA
GetTempPathA
GlobalAlloc
GlobalFree
LoadResource
LockResource
ExitProcess
RtlMoveMemory
SetErrorMode
SizeofResource
Sleep
WriteFile
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
CreateFileA
CopyFileA
CloseHandle

user32

wsprintfA

shlwapi

PathFindExtensionA
PathFindFileNameA

shell32

ShellExecuteA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 432KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE