d2a32232efe5581bc353a31435d20b40_JaffaCakes118 | Triage

Sharing

General

Target

d2a32232efe5581bc353a31435d20b40_JaffaCakes118
Size

32KB
MD5

d2a32232efe5581bc353a31435d20b40
SHA1

c3d46013bf0a8f037f1b4aa4ae393d854d8d14d1
SHA256

7fda03245d0ab37f8dd5cfdc6dcfcd63047d6f89926c47c0d1f2e9820a058811
SHA512

ab2db38ac40263d5406fd54769967fd29e8d4716d4bd8f1ec0ed03886fdadda0d274fa627cfe1cde7ad33800dd23c7205c739f83e149f00aa6012a6e1955ae77
SSDEEP

768:8DmN/JaCQ9y7jP6/fHf75DH3LvcNvtWO5:ZN/Uff75rDs1WO5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2a32232efe5581bc353a31435d20b40_JaffaCakes118

Files

d2a32232efe5581bc353a31435d20b40_JaffaCakes118
.exe windows:4 windows x86 arch:x86

543c9cc540f6b4306c1cac9e251f71a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

strncmp
perror
malloc
free
exit
fread
fopen
fgets
strrchr
fclose
fwrite
printf
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
sprintf
getenv
_XcptFilter
_iob
fprintf
_exit
__p___initenv
_strdup
_stat

kernel32

GetModuleHandleA
GetModuleFileNameA
QueryPerformanceCounter
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE