0006e456bbad2682593ef9ef1889a0e4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0006e456bbad2682593ef9ef1889a0e4_JaffaCakes118
Size

23KB
MD5

0006e456bbad2682593ef9ef1889a0e4
SHA1

578c7860ddc22bae9c508c4493b2e2657ecbf5b9
SHA256

ba32a810d1d8ec4ccb6746428f16dc063663e8633401b486aa18981dbbd99b8d
SHA512

0358031165bef7fa56262f8c8c871744c22d2b34819d5365dbaed4a9c0b977d3e737ba29fccca5795ec5c67a34ea9089159ced7dcba1a9ce45d61d58dd6310b1
SSDEEP

384:LguRQAIrD9TeWc6WMYftHY7+Tvpz1qHRKQ1:Lgu4peWYlHnvpx2RKQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0006e456bbad2682593ef9ef1889a0e4_JaffaCakes118

Files

0006e456bbad2682593ef9ef1889a0e4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ca5101ba73066a8cde02d19de5dfd54b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegEnumValueA
RegOpenKeyA
RegSetValueExA

kernel32

GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetACP
GetOEMCP
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
HeapFree
HeapAlloc
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
VirtualAlloc
GetProcAddress
LoadLibraryA

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE