d06cb9bc186f8d148d4e6f20256659c3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d06cb9bc186f8d148d4e6f20256659c3_JaffaCakes118
Size

9KB
MD5

d06cb9bc186f8d148d4e6f20256659c3
SHA1

627756db3af455ee48c85a6af6420a3ee22ecae6
SHA256

e97114aff2c5fd7fe8451137db5087ca65bddb9cec2a4a7b6971c4719956e6c0
SHA512

3258ae701e411b7bc16576a8843f1e51e078cc5bf516ba82039ac10246f588902339becd4c190f9fa59a8a6a6441b7fd97edb23fdee3dc78a293b3f2fac31874
SSDEEP

192:og0BG0d5iYDfi30fvG2P1Y68WiHZd1n5glj4pq8d/o+qP9lxIH9j6gOA6:dS4YDfyYv5bq9otPnxIdROA6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d06cb9bc186f8d148d4e6f20256659c3_JaffaCakes118

Files

d06cb9bc186f8d148d4e6f20256659c3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

621242ad6dbb24506cb3e7891252da11

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
WideCharToMultiByte
lstrcpyA
lstrcatA
ExitProcess
GetModuleHandleA
GetCommandLineA
CreateEventA
CreateProcessA
WaitForSingleObject
CompareStringA
Process32Next
Process32First
CreateToolhelp32Snapshot
HeapFree
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
CloseHandle
GetFileAttributesW
SetFileAttributesA
WinExec
SetFileAttributesW

advapi32

RegOpenKeyA
RegQueryValueExA
RegCloseKey

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE