c796a6677af81f3f492cacbb81560b1b_JaffaCakes118 | Triage

Sharing

General

Target

c796a6677af81f3f492cacbb81560b1b_JaffaCakes118
Size

19KB
MD5

c796a6677af81f3f492cacbb81560b1b
SHA1

9a9b514562e6d320f0156af21a3affaa59b8d343
SHA256

6c0f1973fcde67a2fcb94cd7a9c519f24180c0218179b817b68fe2dc708552be
SHA512

612369ada2f4bc52016202dafee009e361b87309e6909c81a9e0ad24339628daad0b17ecc7e77a693436e6be9df4fac8cb54af97989d714c9c83cfcb24f516e6
SSDEEP

384:VvgDwZbE4ZcBXemlQkMjK3rDVBggcCoftKDdulnfWjvOeo:FqCrIrD/ggcHfgDwln

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c796a6677af81f3f492cacbb81560b1b_JaffaCakes118

Files

c796a6677af81f3f492cacbb81560b1b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5615c7d44f7cb9752fa719ca52761d3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetFileAttributesA
GetTempPathA
lstrcpyA
CloseHandle
lstrcatA
WaitForSingleObject
CreateEventA
GetCurrentThreadId
SetFilePointer
CreateFileA
lstrlenA
GetModuleFileNameA
LoadLibraryA
RtlUnwind
ExitProcess
GetModuleHandleA
WriteFile
GetProcAddress
SetEvent
CreateThread
GetVersionExA
ExitThread

user32

wsprintfA
ShowWindow
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
CreateWindowExA
SetThreadDesktop
CreateDesktopA
CharToOemA
DestroyWindow
PeekMessageA

advapi32

RegCloseKey
RegCreateKeyExA

shell32

SHGetFolderPathA

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ