c0295dea3276f496ecdcbb7f09c211b5_JaffaCakes118 | Triage

Sharing

General

Target

c0295dea3276f496ecdcbb7f09c211b5_JaffaCakes118
Size

408KB
MD5

c0295dea3276f496ecdcbb7f09c211b5
SHA1

86313c5b2a137c9cf2115efc391fe150ccce9f80
SHA256

27c17ac228efd949472eb6ae39a06bdd03800c844493dcca403fd796f28ea264
SHA512

bc65a6f18df716ab98110efa38dc1d1f8f57c1414f5d97a74e243baa053ae55d84a10f7cf073b88e2c713d527db53c4bc1bb6527c07429177619ecdbc0bff407
SSDEEP

12288:1tV9+YJrk3Nmj2nWFEqnxKkCb67CvSjJ2F8qlAXVvsX5x5sP:F9o77qn/O671J2Mq/5e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c0295dea3276f496ecdcbb7f09c211b5_JaffaCakes118

Files

c0295dea3276f496ecdcbb7f09c211b5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aa38912da2b26dac4dac83c5aeefed11

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
GetCommandLineA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
CreateThread
GlobalAlloc
GetStartupInfoA

advapi32

RegQueryValueExA
RegCloseKey
GetUserNameA
RegOpenKeyA

msvcrt

strcpy
malloc
strlen
strcmp
memset
strstr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
realloc

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ