07e9b5ff95ef10279904e86f90351221_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

07e9b5ff95ef10279904e86f90351221_JaffaCakes118
Size

310KB
MD5

07e9b5ff95ef10279904e86f90351221
SHA1

96ec103faa48ffbba077a657589a5df43733ddae
SHA256

99c91fb28bfafbc94f147ba48fe3a0c055385da77219d8e422c7b9b9a56cee46
SHA512

3e381e1b264e4db8173e372f5f3d3865bfff8204fb06c76e3c1a09f004cfb441f736c6b72ec2ae487409108968cf46b14a1d72a3a5d2453fb638125dc37600bc
SSDEEP

6144:d8PXkSgJ9ZLIjM/kh6yRvJthgQRGw6Nut684wX3t2lJD:dGXkdJLD/kh6gbTGw2utgwX9M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07e9b5ff95ef10279904e86f90351221_JaffaCakes118

Files

07e9b5ff95ef10279904e86f90351221_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ba36136460e2640e1deb10a923dc57fe

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcpyW
GetModuleHandleW
VirtualAllocEx
LoadLibraryA
Sleep
ExitProcess
GetDiskFreeSpaceW
lstrcmpA
GetFileAttributesA
InterlockedIncrement
Sleep
SetEnvironmentVariableA
WaitForSingleObject
Sleep
GetLongPathNameA
GetExitCodeProcess
GetPrivateProfileIntA
GetPrivateProfileIntA
GetPrivateProfileSectionA
WriteFileEx
FindResourceW
GetDiskFreeSpaceW
InterlockedDecrement

apphelp

ApphelpCheckExe
AllowPermLayer
ApphelpCheckIME
SdbCreateMsiTransformFile

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dbg
Size: 304KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ