d368799253f0ddc8abff975cdd5cb662_JaffaCakes118 | Triage

Sharing

General

Target

d368799253f0ddc8abff975cdd5cb662_JaffaCakes118
Size

52KB
MD5

d368799253f0ddc8abff975cdd5cb662
SHA1

1c6955f11d4bc1df51e068864a47bc3db925e474
SHA256

61cf8b8494c65b218fac93823906a2d4bb20d243389eaf5c6f4965de6a5de27d
SHA512

ac81e879345c11dbbf3fc22ae0a1f29070be0e680c329f435da9562b4438e3d5ba558b8ba9e9427a6b94e4bce1e2beb569498fb3cd35dcc171aeddf27ef694ec
SSDEEP

1536:Wv8r7b0OuAnlC9YiR2xZML2EoeACnJ278QGmldqvHg4Wv+Uy0DQS02hZs:Wv8r71nlC9YiR2xZML2deACnJ278QGmG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d368799253f0ddc8abff975cdd5cb662_JaffaCakes118

Files

d368799253f0ddc8abff975cdd5cb662_JaffaCakes118
.exe windows:4 windows x86 arch:x86

cf42e081ec10473e3c62bde3e97d4be5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegSetValueExA
RegCloseKey

kernel32

CloseHandle
CopyFileA
CreateFileA
DeleteFileA
ExitProcess
FindResourceA
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
LoadResource
LockResource
OpenProcess
SizeofResource
WaitForSingleObject
WinExec
WriteFile
WriteProcessMemory
lstrcatA
lstrcmpiA
VirtualFree
VirtualAlloc
ReadProcessMemory
GetCurrentProcessId
SetLastError
CreateRemoteThread
ResumeThread

user32

FindWindowA
GetWindowThreadProcessId

Sections

.text
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

RT
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE