da324bdee7e35efb42e928cf5377152d_JaffaCakes118 | Triage

Sharing

General

Target

da324bdee7e35efb42e928cf5377152d_JaffaCakes118
Size

6KB
MD5

da324bdee7e35efb42e928cf5377152d
SHA1

1822749181322512d8f18173a6fc315f39a9b8a5
SHA256

e722bc4cd15424f61bc5e799d7fa57b38cbc5c56be1faf673d8833068c45dec7
SHA512

0981f20142dde3f3f8625581320e1cd4b79c6bc3c8fe5215cbae2a1bd980939035a23a5bed6d93a9470f0247fdf4b9fdd088e814cebafb47e8f137be14e61376
SSDEEP

96:1dpLKKhodOlLnU+MriZMSI2q3iBAezYsQFKu:HQOwriWX22iSAQFK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da324bdee7e35efb42e928cf5377152d_JaffaCakes118

Files

da324bdee7e35efb42e928cf5377152d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a3abec400087d94181b7f5873a6cc102

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

WaitForInputIdle

mfc42

ord800
ord690
ord1988
ord389
ord3215
ord3173
ord5207
ord5356
ord537
ord353
ord6385
ord3318
ord1979
ord5583
ord665

msvcrt

??1type_info@@UAE@XZ
_mbsstr
sprintf
memset
strlen
atoi
_mbschr
__CxxFrameHandler
strcmp
strcpy
strcat
??3@YAXPAX@Z

kernel32

GetModuleHandleA
CopyFileA
CreateFileA
GetCurrentProcessId
OpenProcess
CreateProcessA
CloseHandle
CreateEventA
OpenEventA
SetEvent
WaitForSingleObject
GetSystemDirectoryA
DeleteFileA
GetTempPathA
GetProcessHeap
HeapAlloc
GetStartupInfoA
GetTempFileNameA
ExitProcess
GetCommandLineA
GetModuleFileNameA

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

shell32

ShellExecuteA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE