fdc7bb8c1a95ad281e72005bdc7d3586_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fdc7bb8c1a95ad281e72005bdc7d3586_JaffaCakes118
Size

7KB
MD5

fdc7bb8c1a95ad281e72005bdc7d3586
SHA1

a2bb756cea947397b2c46402de8c3f66fc1e8b58
SHA256

5273aba2974d6bb2990ea8513566d5b74b8c9aaaf0d23b6809841a300fad0c46
SHA512

6d1aa367b4c86d4c6387af3fd0150d654c635261e7ec0e361406fc725ce09efab5f8b0d5ebe93ac123c0c934815efeab96631a7cdf0d3d02ef6499de97550c61
SSDEEP

192:w0ERKkq3JZWGeJM8Kj3tYGOGBsGorv/v:w0dmJK5orXv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdc7bb8c1a95ad281e72005bdc7d3586_JaffaCakes118

Files

fdc7bb8c1a95ad281e72005bdc7d3586_JaffaCakes118
.exe windows:4 windows x86 arch:x86

05acb3d24079a4ad3ff3d7912f1f41b3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetModuleFileNameA
SetEvent
CloseHandle
lstrcpyA
GetModuleHandleA
lstrcatA
VirtualQuery
InterlockedExchange
ExitProcess
CreateEventA
LoadLibraryA
CompareStringA
Process32First
CreateToolhelp32Snapshot
RtlUnwind
FreeLibrary

user32

DestroyWindow
BeginPaint

advapi32

RegCloseKey

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE