1806943169f838e5b53a316a417e40e1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1806943169f838e5b53a316a417e40e1_JaffaCakes118
Size

21KB
MD5

1806943169f838e5b53a316a417e40e1
SHA1

89896a56b370b6b12c88d507cdfc0f9b993c0bee
SHA256

bc1755bae0055ecfb0799964531e2f74e0c2990d6993c4fa1d4da95b0e60a0c8
SHA512

14122b56249144e609e677a0855d87c6cfbe91bbf94e560ed034c040ebf253d8b713260ce724c9899cc86e45746ba0a31c199e107aadd4c0686b4c1eb8eb7699
SSDEEP

384:41YhcMdCrbsrbE9EjNc9vel0r6BgX14rsA4:41YhVdC/s/E9Eh4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1806943169f838e5b53a316a417e40e1_JaffaCakes118

Files

1806943169f838e5b53a316a417e40e1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

952eccfa3e0f65648886e6dda6cf5d4b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathA
GetVersionExA
GetWindowsDirectoryA
GetProcessHeap
HeapAlloc
HeapFree
LoadResource
LockResource
FindResourceA
GetModuleFileNameA
SetCurrentDirectoryA
SizeofResource
CopyFileA
lstrcatA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA
GetCommandLineA
CreateProcessA
ExitProcess
DeleteFileA
MoveFileExA
RemoveDirectoryA
WritePrivateProfileStringA

user32

MessageBoxA
wsprintfA

advapi32

RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

comctl32

InitCommonControls

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE