002c5052918954047c2d2414faa799f5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

002c5052918954047c2d2414faa799f5_JaffaCakes118
Size

172KB
MD5

002c5052918954047c2d2414faa799f5
SHA1

0e90e24a66290aabaecc1d5c3b3d68e8a02294b0
SHA256

c0bfbde72b8d6f7a501dfac12cda9751d47b457fe5e5cd994c0b57cf53cb0ad4
SHA512

97bf7a314432d9d58626aa0041eed8a0774d1ecdac7a8c648f1b5ffe2762b0f727352419c545e48c98ad01bf6e8a0d70c1b437ff319691e1b2a3a975a1bb2081
SSDEEP

1536:B+xtFAjJE2iLBQGvNTJgAY//cAe6OJkTZWa87lLz6RJgSBAf3DlO1inmURePjJHu:jjJEvbTJBnAeSU9UBs3D0128PjZLRiFl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
002c5052918954047c2d2414faa799f5_JaffaCakes118

Files

002c5052918954047c2d2414faa799f5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

aaa4c9b5cced5e86199c0db047e7ac52

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetModuleFileNameA
GetTempPathA
CloseHandle
CreateFileA
Sleep
GetStartupInfoA
GetModuleHandleA

user32

ShowWindow
TranslateMessage
DefWindowProcA
RegisterClassExA
DispatchMessageA
CreateWindowExA
GetMessageA
PostQuitMessage

shell32

StrStrA

msvcrt

_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
srand
time
rand
fclose
sprintf
fwrite
fopen
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_strlwr

urlmon

URLDownloadToFileA

shlwapi

SHGetValueA
SHSetValueA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 140KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ