08ca70f16f90683ffec2d6835801467a_JaffaCakes118 | Triage

Sharing

General

Target

08ca70f16f90683ffec2d6835801467a_JaffaCakes118
Size

26KB
MD5

08ca70f16f90683ffec2d6835801467a
SHA1

b3d22ee15f627e5480c811a4dd5f8087e2eec0dd
SHA256

697396dc0ed9a6efdfb71cf031ca224bc8d1a8c380e05bec322a62bbec181ee0
SHA512

335e0cead46ccab62e13d76b1d2eee99c94fe358b88805218a785ab344d5b44c7248ec2d15b495d673c4232b0d5be82b900bb02785709307941d67b8dc61e07f
SSDEEP

384:rEr7c+afy/o+lre0KDu/EItlQBUmckk5s+Hk5LYKvatcpiYbn:4roHfy/JlyS/EYlMckkY5I2n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08ca70f16f90683ffec2d6835801467a_JaffaCakes118

Files

08ca70f16f90683ffec2d6835801467a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

f0d35ec903c72dc2613ecb0d44ed71be

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA

kernel32

ExitProcess
ExpandEnvironmentStringsA
FindResourceA
GetCommandLineA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetTempPathA
LoadResource
MapViewOfFile
ReadFile
ReadProcessMemory
ResumeThread
RtlMoveMemory
SetEnvironmentVariableA
SizeofResource
DeleteFileA
TerminateProcess
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtectEx
WritePrivateProfileStringA
WriteProcessMemory
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
CreateProcessA
CreateFileMappingA
FindClose
FindFirstFileA
FlushFileBuffers
WriteFile
RtlZeroMemory
SetCurrentDirectoryA
CreateFileA
CloseHandle
Sleep

shell32

ShellExecuteA

advapi32

RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA

comdlg32

GetOpenFileNameA

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ