15f3d56874656a10292f40d5d364c981_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

15f3d56874656a10292f40d5d364c981_JaffaCakes118
Size

64KB
MD5

15f3d56874656a10292f40d5d364c981
SHA1

1d3bbc968bb678f2b6d9810eedd4fcac066b5e2d
SHA256

21c234e46173ac2584ee1f9b97405490bf45341afb2c9a0846808c003afed87e
SHA512

1ea8000ace8be9597a8dba737ba14fc89168f44f6305013e1011b6b93b20a0428357286548aab7e2a2a23ed0d10054224c3afaccd1af0aeaa44c178100e894af
SSDEEP

768:SDhP5T1JHzx+2IQIMaXxstaGetXX58v+RqtwbB4PQBovzz7xoyxh:o1JHIUIBXegGetXavltw4uovzzdoyxh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15f3d56874656a10292f40d5d364c981_JaffaCakes118

Files

15f3d56874656a10292f40d5d364c981_JaffaCakes118
.exe windows:5 windows x86 arch:x86

783c70e95bd471cc2787dc94454ca049

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
SetEnvironmentVariableA
WaitForSingleObject
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
GetPrivateProfileSectionA
GetDiskFreeSpaceW
Sleep
GetExitCodeProcess
lstrcmpA
GetFileAttributesA
VirtualAllocEx
GetPrivateProfileIntA
GetDiskFreeSpaceW
lstrcpyW
GetLongPathNameA
Sleep
WriteFileEx
FindResourceW
GetPrivateProfileIntA
Sleep
ExitProcess

apphelp

ApphelpCheckIME
AllowPermLayer
ApphelpCheckExe
SdbCreateMsiTransformFile

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rss
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ