1496583bb24e3c475bd390191db086a2_JaffaCakes118 | Triage

Sharing

General

Target

1496583bb24e3c475bd390191db086a2_JaffaCakes118
Size

64KB
MD5

1496583bb24e3c475bd390191db086a2
SHA1

d2cde94152fde131a5268071f0a041075f48ed6f
SHA256

c776c697de43be5877d54f88178bde21d910faeb41c011db24606d90b2ff63c8
SHA512

db9116d9a0a84f5e9f6999a7f063cedcc0be0f2fbeb3d6e8017446d13731aabcc21e27d62b02c01bd02e65dbc24c6af7c196353491b766f74105c804de24a9fa
SSDEEP

384:xMY7vD0lAbq6S1+x5fuTrSyc2zpzeNoURl8jWabLGI4KOSo4Dl0uxwF3q:xz7vDRblrTGC2iN1l8LnpxlLlI6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1496583bb24e3c475bd390191db086a2_JaffaCakes118

Files

1496583bb24e3c475bd390191db086a2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

48af946d5a1a35562cda15849667e9a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WaitForSingleObject
CreateEventA
GetCurrentProcessId
lstrcatA
ReleaseMutex
FreeLibrary
ResetEvent
SetFileAttributesA
CompareStringA
CreateToolhelp32Snapshot
Process32First
Process32Next
ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
HeapAlloc
GetProcessHeap
CreateProcessA

user32

GetClassLongA
wsprintfA
ShowWindowAsync

shell32

SHGetFolderPathA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 806B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE