ebfd30bb2abcac4a9b81594d3be3f646_JaffaCakes118 | Triage

Sharing

General

Target

ebfd30bb2abcac4a9b81594d3be3f646_JaffaCakes118
Size

28KB
MD5

ebfd30bb2abcac4a9b81594d3be3f646
SHA1

2d7e8734a22ea5de4500e16043ea82a80e6b6dce
SHA256

084e6002580c36b8a84039eb397d5512c49009ae73f4e09bc2419ed7440b0a95
SHA512

5e246580090165ab4f158a64b165c95b8fd9f700c89b806fd82eb9de0d519530e27618535c71635aa728f1c8b448ccf8b6c03adc2ea40e562805b4b802e54b12
SSDEEP

384:fd3vPR3+2/bZ5sHTh6aOToqzvCm6tFu3WZk3t:fFP5bZ5+DOtz6tAJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebfd30bb2abcac4a9b81594d3be3f646_JaffaCakes118

Files

ebfd30bb2abcac4a9b81594d3be3f646_JaffaCakes118
.exe windows:4 windows x86 arch:x86

794f720491cfb3bab7d3b7c35e78cd9d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

msvcrt

fread
perror
malloc
fclose
sprintf
free
fopen
strspn
strcspn
fgets
fwrite
getenv
strncmp
_XcptFilter
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
printf
_iob
fprintf
exit
strchr
strrchr
_exit
_strdup
_stat

kernel32

QueryPerformanceFrequency
GetModuleHandleA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
QueryPerformanceCounter

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE