f6514e52a2650e9d9ff17deeb73563e3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f6514e52a2650e9d9ff17deeb73563e3_JaffaCakes118
Size

76KB
MD5

f6514e52a2650e9d9ff17deeb73563e3
SHA1

f6d14dee24fef3c042d6aeb54cb65314761f382a
SHA256

eb0aab9d93caa6745b3d204db6814ba78ba8ec2ee9a2cb26a1f9702228bd4fc8
SHA512

005c76bd26662bdaadb1e107163ab96a5290a04e4afbd1010b64e91529dc70c866671df88b8f89aed4fb4c1d81ec2f46ada7e5ba966d6e8db4afb0e02a82c7f7
SSDEEP

1536:8KMTxXAhuyjqi6UrVDrv8OaFfmc+2hu2tD:8tXAhi9UrVvDaFOt2kO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6514e52a2650e9d9ff17deeb73563e3_JaffaCakes118

Files

f6514e52a2650e9d9ff17deeb73563e3_JaffaCakes118
.exe windows:5 windows x86 arch:x86

9e931ccbcc0e75011f69320539267c13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
lstrlenA
lstrcatA
GetTempFileNameA
GetLocalTime
GetModuleHandleA
VirtualProtect
FindResourceA
LoadResource
LockResource
OpenMutexA
WriteFile
ReadFile
SetFilePointer
CreateProcessA
GetModuleFileNameA
MoveFileA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetTickCount
CreateFileA
SizeofResource
ExitProcess
IsDebuggerPresent

user32

wsprintfA
CreateWindowExA
RegisterClassA
PostQuitMessage
SendMessageA

advapi32

RegCloseKey
RegCreateKeyA
RegCreateKeyExA
RegSetValueExA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.code
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ