301c92f22920b13970a120f9d58a28c9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

301c92f22920b13970a120f9d58a28c9_JaffaCakes118
Size

8KB
MD5

301c92f22920b13970a120f9d58a28c9
SHA1

8e9ea08518ec9c52dd9981064a85ad4bc10f90c2
SHA256

6e79906da1339f77a9a6963b3ba2bae360eb1245c57a565a497867faf2e5a8d7
SHA512

43dd02678570345415c367749857b4e6cd438b09c64b15998916591313fec48af5f6f540dfd148dda4c4da8338595c8105e161f8a087cb1103feb56551d48491
SSDEEP

96:3jrxEyFlnpkGd3aabLXKWxM/paKEiYzusDuAkPLiUmeFKOeO9XWLOb2D0gcPw:3R5Fhp8cdwpHR3AkPLiM79mLU2PcY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
301c92f22920b13970a120f9d58a28c9_JaffaCakes118

Files

301c92f22920b13970a120f9d58a28c9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9892338e2daa9eda983ff8396c009e4e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

crtdll

memset
memcpy
remove
_mkdir
free
_chdir
_rmdir
malloc
_ltoa
strncpy
strlen

kernel32

GetModuleHandleA
HeapCreate
lstrlenA
GetModuleFileNameA
GetTempPathA
GetTempFileNameA
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
HeapDestroy
ExitProcess
Sleep
GetExitCodeProcess
InitializeCriticalSection
GetCommandLineA
HeapAlloc
HeapFree
HeapReAlloc

shell32

ShellExecuteExA
ShellExecuteA

shlwapi

PathQuoteSpacesA
PathAddBackslashA
PathRemoveBlanksA
PathFileExistsA
PathRemoveFileSpecA

Sections

.code
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.flat
Size: 1024B - Virtual size: 621B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE