36f527d6ab166569ec58d39eb1dfda86_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

36f527d6ab166569ec58d39eb1dfda86_JaffaCakes118
Size

16KB
MD5

36f527d6ab166569ec58d39eb1dfda86
SHA1

6e8e7acfe8acf9d0832116ec6a559c75fa22bed0
SHA256

e49cfa0422716fb6646c42eb8b71357545aaea73322ed78dd5daa12546a8419a
SHA512

37df151fc8e2d8869c156d3ba9c58036d712499b7b7a00248bc987af404405b4cab403e8d7dfa1f4e93da0e34b9d3612229eddd3889de5f104f72c467c42c4b3
SSDEEP

384:pWzMNl6EU34CbW0Pv5yNWWHY4cYdZrqtLV:UMNl7UICVO5dZrsV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36f527d6ab166569ec58d39eb1dfda86_JaffaCakes118

Files

36f527d6ab166569ec58d39eb1dfda86_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a158590b0b76fc11e3d2e1c31423c472

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegSetValueExA
RegCreateKeyA
RegOpenKeyExA
RegCloseKey

user32

wsprintfA

shell32

ShellExecuteA

msvcrt

_XcptFilter
exit
__p___initenv
__getmainargs
_initterm
_exit
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
fopen
fwrite
fclose
__setusermatherr

kernel32

lstrlenA
WinExec
Sleep
LoadResource
SizeofResource
LockResource
GetSystemDirectoryA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 668B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ