2612dae39e862c8e748dd000e96e2b14_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2612dae39e862c8e748dd000e96e2b14_JaffaCakes118
Size

63KB
MD5

2612dae39e862c8e748dd000e96e2b14
SHA1

56d6bdf6db7716d3772f74efc5136d86bd98b938
SHA256

a4edd8b317806c68fbc041405891c2ce066579cfefb15ff8b9e713b04ef720bb
SHA512

bbf23bec87aad8bee162d3724d502e54c796d040698110730b8fe6255450625c2e34a9023ead7b5d60872c791d1782f5c875aff4b89851f4a00a6ba9577821db
SSDEEP

1536:oU3EiDAJiAkmdAlqI2GBMtr1SItWTspOUbRWg4RTK:o63McBP6r1uspRWg6TK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2612dae39e862c8e748dd000e96e2b14_JaffaCakes118

Files

2612dae39e862c8e748dd000e96e2b14_JaffaCakes118
.exe windows:4 windows x86 arch:x86

51f528638084318d5552f9b372ebe7f1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

ole32

CoUninitialize
CoInitializeEx

shell32

ShellExecuteW
ShellExecuteExW

user32

MessageBoxW
wsprintfW

kernel32

GetCommandLineW
CreateFileW
GetModuleFileNameW
LoadLibraryA
WriteFile
lstrcpyW
DeleteFileW
GetExitCodeProcess
CloseHandle
LoadResource
GetProcAddress
SetEnvironmentVariableW
LockResource
GetStartupInfoW
ExitProcess
WaitForSingleObject
GetTempPathW
SizeofResource
FindResourceW
GetLastError
FreeLibrary
GetModuleHandleW

Sections

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 538KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ