ddb44425cde3aa3d7c6905a3be396fef_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ddb44425cde3aa3d7c6905a3be396fef_JaffaCakes118
Size

120KB
MD5

ddb44425cde3aa3d7c6905a3be396fef
SHA1

6987ca471d9d5bc8e11ea66d658dee87d85565a3
SHA256

343533dcb60d6ffe659e3e43b940e59720bc54f2afee4f27c98d60b6f17897ce
SHA512

1034d695191f1e5bc2342d0414806d060d3fd17dca75caf1811ab4c97b9c04684022dbf1599de2dcfcb6d40e7567193dba8f34655b0c755816f331b2ad54801b
SSDEEP

3072:SOsBFBvn04lMDZOsZBomy3J63TgASbV/A65h:SOsBFhQVlBomgSSR/t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ddb44425cde3aa3d7c6905a3be396fef_JaffaCakes118

Files

ddb44425cde3aa3d7c6905a3be396fef_JaffaCakes118
.exe windows:4 windows x86 arch:x86

897bb75fe81ae1929c7ba42a40a262ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
CreateProcessA
GetEnvironmentVariableA
CreateDirectoryA
GetProcAddress
LoadLibraryA
WriteFile
GetModuleHandleA
GetVersionExA
CloseHandle
GetTempPathA
DeleteFileA
lstrcpyA
WaitForSingleObject
LoadResource
FindResourceA
CreateFileA
LockResource
ExitProcess

setupapi

SetupIterateCabinetA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegCreateKeyExA

user32

wsprintfA
MessageBoxA

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ