da420c861f29c4bbcc45943f8488e5d5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

da420c861f29c4bbcc45943f8488e5d5_JaffaCakes118
Size

9KB
MD5

da420c861f29c4bbcc45943f8488e5d5
SHA1

c6dbdcc35c2f6823194e55b5d1d5752db2af18e1
SHA256

c3b7ab9fd3560e2515f0595bc0b1a5b31b0dc01e9ed41bc904964e1c34de0bbd
SHA512

9b000a4d2cc5b96d8760313706616d3392f86470ca03d6188de6cf89fea25a72b98a3321b33db22fb6c233c8626f8ae550bf2b06a4e14c7729f81221cc041cc7
SSDEEP

192:+LwuwsGjnpno1SYYStPBAgmsDpQM9oLBO5Yctz+0O:8VGbpo1SYYs6M6O5Yctz/O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da420c861f29c4bbcc45943f8488e5d5_JaffaCakes118

Files

da420c861f29c4bbcc45943f8488e5d5_JaffaCakes118
.exe windows:5 windows x86 arch:x86

761568868ed56277d545e5e62736e31a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

StrToIntA
StrStrIA

kernel32

VirtualFree
GetWindowsDirectoryA
WriteFile
GetVolumeInformationA
ReadFile
FindFirstFileA
VirtualAlloc
FindClose
CloseHandle
GetTempPathA
LocalFree
ExitProcess
HeapAlloc
lstrlenA
WaitForSingleObject
SetEvent
GetProcessHeap
GetCommandLineA
Sleep
CreateEventA
InterlockedExchange
GetModuleFileNameA
GetModuleHandleA
WinExec
CreateThread
GetProcAddress
LoadLibraryA
lstrcatA
GetEnvironmentVariableA
GetFileSize
CreateFileA
GetComputerNameA
HeapFree

user32

wsprintfA

advapi32

RegCloseKey
GetUserNameA
SetEntriesInAclA
RegSetValueExA
RegCreateKeyA
SetNamedSecurityInfoA

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE