e07921663dbe4e5775554838bfef3a49_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e07921663dbe4e5775554838bfef3a49_JaffaCakes118
Size

352KB
MD5

e07921663dbe4e5775554838bfef3a49
SHA1

2276586d66f6c8a524a36506cedc83c993844d2a
SHA256

eccc33f54c1080a2faf7338b0d567244c1a0fbdc6e10b018fb0d1e5e6ed14ea8
SHA512

be9c02374cb5717698be17f243d8668c67e40e600dade100b168b451270fc221b36b638a51247eb97379f3065a750427d9c7ee98748e3b9dc85a6e8f7bfb3204
SSDEEP

6144:JUO9KvqMBGVIAT6O9Fy8kI68/nZPyHSF9I/9M/q4cNoo+S/RtyW1Opw9IQD:T9KvrEdLyvynk/9M/qrNooV/REWQpw9z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e07921663dbe4e5775554838bfef3a49_JaffaCakes118

Files

e07921663dbe4e5775554838bfef3a49_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7b0061304054d179fe2e82f52b4df34a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FreeResource
GetDriveTypeA
GetFileAttributesA
GetLogicalDrives
GetModuleFileNameA
GetSystemDirectoryA
GetTempPathA
GlobalAlloc
GlobalFree
LoadResource
LockResource
ExitProcess
RtlMoveMemory
SetErrorMode
SizeofResource
Sleep
WriteFile
lstrcatA
lstrcmpA
lstrcpyA
lstrlenA
CreateFileA
CopyFileA
CloseHandle

user32

wsprintfA

shlwapi

PathFindExtensionA
PathFindFileNameA

shell32

ShellExecuteA

advapi32

RegCreateKeyExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 347KB - Virtual size: 412KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE