d4012b604eafe34453616ed70e9acd6b_JaffaCakes118 | Triage

Sharing

General

Target

d4012b604eafe34453616ed70e9acd6b_JaffaCakes118
Size

14KB
MD5

d4012b604eafe34453616ed70e9acd6b
SHA1

9a092b1878dad8289c2c51cdd9aae45ae8e122ba
SHA256

bfaa300acdb43bd21791ecd811c7f93fa43895412f07cbe0c9b9c4a8719eb7de
SHA512

fa849dd2bd44f6a06f33919a8ed8cbf39ed3ee985311e7f10e1ae8fbf5f7023b56baed0b141bbcb8be69fa3cafeaca3d5e2fe23ac1964dd493b56f389be3af39
SSDEEP

192:MQOMoiwYf9O/MEHRavDrQdD4I9Xmpiw7PTCebblVqbXIody4LQt:8niwY0/MEHRavyRmwibPqbYKLQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4012b604eafe34453616ed70e9acd6b_JaffaCakes118

Files

d4012b604eafe34453616ed70e9acd6b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

88e6948a93405be4ab5910f2e014e7ed

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
strncpy
_strnicmp
strncmp
_strdup
free
strlen
strcpy
strcat
memcpy

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
ExpandEnvironmentStringsA
LocalSize
LocalFree
GetTempPathA
HeapAlloc
WideCharToMultiByte
FindClose
FindFirstFileA
GetLastError
FindNextFileA
GetDriveTypeA
GetFileAttributesA
WriteFile
HeapFree
CloseHandle
CreateFileA
GetFileSize
ReadFile
HeapReAlloc

advapi32

RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

Sections

.code
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE