060aa9887dc675e5968fb5be482d4d21_JaffaCakes118 | Triage

Sharing

General

Target

060aa9887dc675e5968fb5be482d4d21_JaffaCakes118
Size

70KB
MD5

060aa9887dc675e5968fb5be482d4d21
SHA1

c5deec2a2b4577158c9e39ea802844e4fca4ceda
SHA256

77206e1017bdb721b3a6827cbdcc5b3494fcd38a68c0414e4a74c5b8618cc3b6
SHA512

ba8b7bf93229dd5f63c9ab41600ce05219601846d615bd3c1ddb770da572b9ae6db2d579f3ec03570bac4ae22bff3db980fa092287e1b535c5c8f30f6e9cee90
SSDEEP

1536:jwury2B/xoZRSQ6Tn3/nC9spLKHt7c4eBs+DB8QwN3ZzpswlTUjQNwrZeW+E:jwury2B/xoZj6T3vC9spWHt7osQozps3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
060aa9887dc675e5968fb5be482d4d21_JaffaCakes118

Files

060aa9887dc675e5968fb5be482d4d21_JaffaCakes118
.exe windows:4 windows x86 arch:x86

95fb0bcb64cdd38078ee57eb00ec1e05

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

DeleteFileA
ExitProcess
FindResourceA
GetCurrentProcessId
GetModuleHandleA
GetProcAddress
GetSystemTime
CreateFileA
GetTempFileNameA
GetTempPathA
GetWindowsDirectoryW
LoadResource
CloseHandle
SystemTimeToFileTime
VirtualAlloc
VirtualFree
WriteFile
GetSystemTimeAsFileTime
SizeofResource

msvcrt

_snprintf
strncat
_snwprintf

advapi32

RegSetValueExA
RegCreateKeyA
RegCloseKey

shlwapi

SHGetValueA

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 886B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ