d1aa28b5503d69a2aa26fa9b358911ea_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d1aa28b5503d69a2aa26fa9b358911ea_JaffaCakes118
Size

23KB
MD5

d1aa28b5503d69a2aa26fa9b358911ea
SHA1

3a4e0f260c63407314a2f2a74c09057a45d633ec
SHA256

92155b988d302337bc58ea6b60058497d3e6c5e870a992d99beb70da21f39536
SHA512

ac5bde7903419c224f42271071beb1e0576b5302d6298c170ac4546758ac060debbd1c4d5d4c95f49ea115c8272c316ca1aa375c1c296fc05968423c9ee43492
SSDEEP

384:y2515Gv2umCQalsEEOq24/XM8olbzOfoX/sUj08Ye3ys:J1kmCeMBHDYe39

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1aa28b5503d69a2aa26fa9b358911ea_JaffaCakes118

Files

d1aa28b5503d69a2aa26fa9b358911ea_JaffaCakes118
.exe windows:5 windows x86 arch:x86

7a1477029a5551514d0b9c319792fd6d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteFile
OpenProcess
CreateProcessA
lstrcatA
GetEnvironmentVariableA
lstrcmpiA
GetProcAddress
CopyFileA
CreateRemoteThread
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
CloseHandle
WriteProcessMemory
DeleteFileA
lstrcpyA
GetCurrentProcess
lstrlenA
VirtualAllocEx
CreateFileA

user32

GetWindowThreadProcessId
FindWindowA

advapi32

RegOpenKeyExA
RegCloseKey
RegSetValueExA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ