17c891904f1237934581cefdb9a58757_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17c891904f1237934581cefdb9a58757_JaffaCakes118
Size

20KB
MD5

17c891904f1237934581cefdb9a58757
SHA1

2a03b1bdc799cc74f86f7d9e6d7535fc409539aa
SHA256

e1d98e38202eabc31964f01963c57580e13836dc271fd53b9445a78a19336e9b
SHA512

e96ca42750d5486481e9a886857367ec9594969582c6279a8a43c9eada5db0d1f8b4f6478bfb936618a6389a530419873635b1db648ee88304d04cac2342f70e
SSDEEP

192:82H95sAtBq4uGyk8Kd3fpH86YNeA5OLtQqrXSajyrpPZiCDr:7XO4u5kJdPpc/O55BeVPZ5P

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17c891904f1237934581cefdb9a58757_JaffaCakes118

Files

17c891904f1237934581cefdb9a58757_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dadec85c6ecd35ec689b3f274722201a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegSetValueExA

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter
Sleep

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fclose
fflush
fopen
fprintf
fputc
fputs
free
malloc
signal
strlen

user32

GetAsyncKeyState

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE