dbfecc77682aa8dfba117cac4f396e98_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dbfecc77682aa8dfba117cac4f396e98_JaffaCakes118
Size

13KB
MD5

dbfecc77682aa8dfba117cac4f396e98
SHA1

37a228d3644e52730d7f7d0dc35a42cce41dcf8c
SHA256

ea99c4b091cc564de6b7d77ea2c20a70d824ad5723f9db14185e697b095186a3
SHA512

fc298b7e23c7c9362b62994706bec45425e8ba75bdbd7307173ce2e57c3a22423c84708276e48647b2e8d7776813ab90e9c7519446be0ac557c754aa2a6cab55
SSDEEP

384:LBqVqJFZKdGCMbKyYchbXOX7Xgf9Qqie1Yv:LBS0ZKdGCMBvharXU9Ziea

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbfecc77682aa8dfba117cac4f396e98_JaffaCakes118

Files

dbfecc77682aa8dfba117cac4f396e98_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f332b79fd466ea9c9398b97e2783b20e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
OpenEventA
SetEvent
Sleep
lstrcatA
DeleteFileA
lstrcpyA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
CloseHandle
SetFileAttributesA
GetFileAttributesA
FindClose
ResetEvent
FindNextFileA
ExitProcess
GetModuleHandleA
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
WriteFile
OpenProcess
CreateFileA
GetTempPathA
Process32First
CompareStringA
TerminateProcess
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery

user32

wsprintfA
CharToOemA
MessageBoxA
ExitWindowsEx
ShowWindow

advapi32

RegDeleteValueA
RegSetValueExA
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyA
RegCloseKey
RegDeleteKeyA

shell32

ShellExecuteA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE