d5f281b81d26006f1311adade399e3aa_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

d5f281b81d26006f1311adade399e3aa_JaffaCakes118
Size

34KB
MD5

d5f281b81d26006f1311adade399e3aa
SHA1

1d6ab427845167519e8e524268fb5233b47c5e97
SHA256

621a6b8f67e53376a865c54aeda3b8474787c7e9c2efb865589e0b804760e98b
SHA512

6853f939981618d451f6c567925163065a56a90e39c7608d74b2512fcbbc891fb28f61b4f0c901b4f6aa12beb5b8e1d4fdd8bd3a96aeac5d1fb90d7af958c2ca
SSDEEP

768:+bkpdPUhEDRJGPpFOxLfDPBzk7IfT9txf4BAQ:++BDR0js9PfsN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5f281b81d26006f1311adade399e3aa_JaffaCakes118

Files

d5f281b81d26006f1311adade399e3aa_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7bf7bc612847cd5aab651efe3472bbca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeResource
LockResource
SizeofResource
LoadResource
FindResourceA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
GetFileSize
DeleteFileA
SetCurrentDirectoryA
lstrcpyA
ExitProcess
GetModuleHandleA
GetCommandLineA
lstrlenA
GlobalFree
lstrcatA
GetLocaleInfoA
GetSystemDefaultLCID
GetVolumeInformationA
GetWindowsDirectoryA
HeapFree
GetProcessHeap
HeapAlloc
WriteFile
ReadFile
SetFilePointer
CloseHandle
CreateFileA
GlobalAlloc

user32

wsprintfA
CharUpperA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ