0f4d9249b7d014f81139db76f7bceb7b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0f4d9249b7d014f81139db76f7bceb7b_JaffaCakes118
Size

87KB
MD5

0f4d9249b7d014f81139db76f7bceb7b
SHA1

ec252112b47e722e1db80dbecb630601c0f38a12
SHA256

bb2687c207d7da7192532b73f2dde265a30f57ff0643e4f7f85d5edfbbf30746
SHA512

65ebee2130c894fe2343d8602a23bbb888a14312efa5b684dee1207d4728a4e4e1fb36e7254e5735a7ae0311de23b8e758aeffde89fbe1989e30638d2e3f06a2
SSDEEP

1536:CQGU3/B4ynv7lxS5mwC6hvInyR5gdgd86jJJ2sj9KYmp6f8PKhyAtkZ7SWAB1PgV:cO6ynvRx1LgdNtcC7yAtye8X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f4d9249b7d014f81139db76f7bceb7b_JaffaCakes118

Files

0f4d9249b7d014f81139db76f7bceb7b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

999c6c515c50cf5a3681430a33984388

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strstr
NtMapViewOfSection
isprint
tolower
isspace
_snprintf
memset
memcpy
_chkstk
RtlUnwind
NtQueryVirtualMemory

kernel32

CreateProcessA
VirtualFree
CreateToolhelp32Snapshot
lstrcmpiW
Process32NextW
Process32FirstW
lstrcpyA
ExitProcess
MoveFileExA
GetEnvironmentVariableA
GetModuleFileNameA
GetModuleHandleA
lstrlenA
CreateFileA
GetLastError
DeviceIoControl
CloseHandle
GetThreadContext
SetThreadContext
MapViewOfFile
UnmapViewOfFile
HeapAlloc
HeapFree
GetProcessHeap
TerminateProcess
GetSystemDirectoryA
GetProcAddress
VirtualAlloc
CreateFileMappingA
WriteProcessMemory
ResumeThread

user32

CharUpperBuffA

advapi32

RegCloseKey
RegCreateKeyExA
RegQueryValueExA

shell32

ShellExecuteA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE