105c94b1e42ee1e9f5f680c33cae4aa3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

105c94b1e42ee1e9f5f680c33cae4aa3_JaffaCakes118
Size

177KB
MD5

105c94b1e42ee1e9f5f680c33cae4aa3
SHA1

0961436148357c3dfb6797e2f896e9ca750f3d5b
SHA256

f5f01c9ae23cf9b887c638d50d1e1ef053eddd88157f097a4615115d27cfb838
SHA512

cc78450cc14f8b71618afb6f4e3fd53ed8f45ebf766cc96492896bc823b93264ab5c67842bab5fa9ce63046ff0ae3be089d121a6cb3bbadc878562ba9efd2f0d
SSDEEP

3072:5kHFSO8g1+peg7FzKJWsMUMOVOmvsQXB+uv9K51Ot3bS58QJUGxNsSaA2Fb2H6S3:sFb8gcplpz1sMUZVLDXB+uvo5CLmRZxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
105c94b1e42ee1e9f5f680c33cae4aa3_JaffaCakes118

Files

105c94b1e42ee1e9f5f680c33cae4aa3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bac8e2236bdfec74ee33448129f2956b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualAlloc
lstrlenW
GetProcAddress
FindResourceA
GetModuleHandleA
GlobalAlloc
GetACP
LoadLibraryA
GetModuleFileNameA
SetLastError
WaitForSingleObject
GetLastError
GetModuleHandleW
GetCommandLineW
ExitThread
ExitProcess
IsBadReadPtr
GetCommandLineA

shlwapi

SHQueryInfoKeyA
SHSetValueA
PathIsDirectoryA
SHStrDupA
SHGetValueA
SHQueryValueExA
SHDeleteKeyA
PathGetCharTypeA
PathIsContentTypeA
SHDeleteValueA

version

VerQueryValueA
VerInstallFileA

Sections

CODE
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ