111898e360a61b4e598d310c8dd44f60_JaffaCakes118 | Triage

Sharing

General

Target

111898e360a61b4e598d310c8dd44f60_JaffaCakes118
Size

128KB
MD5

111898e360a61b4e598d310c8dd44f60
SHA1

04c1868d2114b078c56308bd518aeb12c661a781
SHA256

09b004cfb6b8cd132e536eae22c24457dc8c8851bfbc9c6de14e042c7144989a
SHA512

26697c2c8d251c55f63f8d88fa25fbd245f1f5c7e62e830ef380c5387e9af02ad413b2d4fd4861fa2cc32ad0bbc2526e5688013969c0517e6ec2bed1b6a408a6
SSDEEP

3072:DqX6WIH9LcfioWXgW1n9QUn90YbVJ1Kf83r8:DqqHFcfioYLnSA90YJJ1Kgr8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
111898e360a61b4e598d310c8dd44f60_JaffaCakes118

Files

111898e360a61b4e598d310c8dd44f60_JaffaCakes118
.exe windows:5 windows x86 arch:x86

2de8ce111210b1c84ef77f5d0a32459a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
LoadLibraryA
Sleep
GetDiskFreeSpaceW
GetLongPathNameA
GetDiskFreeSpaceW
lstrcmpA
Sleep
WriteFileEx
GetPrivateProfileIntA
WaitForSingleObject
GetPrivateProfileSectionA
lstrcpyW
GetFileAttributesA
SetEnvironmentVariableA
FindResourceW
GetPrivateProfileIntA
VirtualAllocEx
InterlockedDecrement
GetModuleHandleW
Sleep
InterlockedIncrement
GetExitCodeProcess

apphelp

ApphelpCheckExe
SdbCreateMsiTransformFile
AllowPermLayer
ApphelpCheckIME

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dbg
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ