e001b8a2d7f2890f5e6993ebbf5ab30c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e001b8a2d7f2890f5e6993ebbf5ab30c_JaffaCakes118
Size

87KB
MD5

e001b8a2d7f2890f5e6993ebbf5ab30c
SHA1

bbff904a4fcd0f308b92b52d560ad1b973d802f2
SHA256

f18a25b3108f6083440263e9351ed5a26a1c5b944000d73d35196e52e1d8757b
SHA512

f5cae7a2f1af6552fd22928d8b68d16d60607a1c9b10028d58a5ae431c03b6ef7e3c6f130a1915e1f3b839e09d17822b400d2d0c033e5d352e0c8f4514de2b39
SSDEEP

1536:hl2zWg+Rsrle58yodOVkjyVBa9y175wi7EmoRWYebu3Am5tXBK/BZnQ5:hlXgqGA5yYVhBa9SAmV/uBH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e001b8a2d7f2890f5e6993ebbf5ab30c_JaffaCakes118

Files

e001b8a2d7f2890f5e6993ebbf5ab30c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a4c2d911cb3e5d68751691a8b9615085

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcmpiA
LoadLibraryA
VirtualProtect
GetModuleFileNameA
ExitProcess

user32

wsprintfA
MessageBoxA

advapi32

CloseServiceHandle

shell32

ShellExecuteA

psapi

GetModuleFileNameExA

msvcrt

_stricmp

shlwapi

SHDeleteKeyA

netapi32

Netbios

Sections

.code
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.axl0
Size: - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

.axl1
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ