0fd78ed11fd786abab452c5430f10032_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0fd78ed11fd786abab452c5430f10032_JaffaCakes118
Size

372KB
MD5

0fd78ed11fd786abab452c5430f10032
SHA1

7ea4b2dd9af097ffccdc24b82459efabfff24057
SHA256

cea7226d66c4fbf29d26fe5c37a6991346bb9de27e42feefa0edca4c50fe1b91
SHA512

388508ca130069259fc9031cfd80f5165f0a6a1409b738051365a7ca286a1d1a203c269046fe44a822496a724a4f184e76305689dd0148d5c64e580ede4513ce
SSDEEP

6144:x3XVkmHY6fFeqYTCausxcpm1mdjyoDY6oRUJPMc2qbcEhb5kIEKiAdSasw:lXZ3FICausuA1mdzDY6VPmEhlkIEKm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fd78ed11fd786abab452c5430f10032_JaffaCakes118

Files

0fd78ed11fd786abab452c5430f10032_JaffaCakes118
.exe windows:4 windows x86 arch:x86

69de618cdc955a816f4eb5858ad6a30b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

memset
memcmp
memcpy

kernel32

HeapFree
WriteFile
CreateFileA
GetEnvironmentVariableA
ReleaseMutex
GlobalAlloc
GetExitCodeThread
DeleteAtom
CreateNamedPipeA
HeapAlloc
GetProcessHeap

ole32

OleUninitialize

winmm

timeKillEvent

shlwapi

SHDeleteKeyA

user32

wsprintfA

advapi32

RegCloseKey

msvcrt

free

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 312KB - Virtual size: 308KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ