dd5309ecc56242be3692652e0fc4440b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dd5309ecc56242be3692652e0fc4440b_JaffaCakes118
Size

65KB
MD5

dd5309ecc56242be3692652e0fc4440b
SHA1

7c80a0132de77160b331f0e3d43cb2799b53e006
SHA256

54e401bf95c58cf3666874ee30ad3131852ed75c2d0858fdd50d1926441a608a
SHA512

7590d2b8af684713cd3af2710d085fe904006b41c5ca96a9e695d941e466555d60c7b25d907e1e893ba5ad8bed29f7c1e584fac5bd87dcdb47dc2ee52b1532a5
SSDEEP

1536:KTUwS6pVwon8p2hWDAauTE4wKUpqO5UOKHnLCqj:KYIpVwo8p2Yh6NTUMgU5Hx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd5309ecc56242be3692652e0fc4440b_JaffaCakes118

Files

dd5309ecc56242be3692652e0fc4440b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f21b7edad07a173e70b47f571f2e033

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

ole32

CoInitializeEx
CoUninitialize

shell32

ShellExecuteW
ShellExecuteExW

user32

MessageBoxW
wsprintfW

kernel32

GetStartupInfoW
DeleteFileW
WriteFile
CloseHandle
VerSetConditionMask
GetProcAddress
GetExitCodeProcess
GetLastError
GetModuleHandleW
LoadResource
FreeLibrary
GetModuleFileNameW
CreateFileW
LoadLibraryA
SetEnvironmentVariableW
lstrcpyW
ExitProcess
CreateDirectoryW
GetCommandLineW
WaitForSingleObject
LockResource
GetTempPathW
SizeofResource
FindResourceW
RemoveDirectoryW

Sections

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 448KB - Virtual size: 445KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ