394fd2f83708d7eeac143a210162a1c7_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

394fd2f83708d7eeac143a210162a1c7_JaffaCakes118
Size

13KB
MD5

394fd2f83708d7eeac143a210162a1c7
SHA1

9fe6af686028f9d92ee0f4a82d1cfddaa8ab5662
SHA256

6576a05e8d2e72d63bd4356a6b345ff5d748f1338a69b0407d9555310da25efd
SHA512

1b4716c32908dd41ab3263e5e75d11a1ffded4794dd024d69cb7bd402ee7689aaed5a0ecd24b8d5fff97c4e466a8fecba2a3b5c2d07c1cf21e66bddeb4e3f21b
SSDEEP

192:FI+UmF1g7yLVNJe3oVqhTEULRC+4U8+EJ3I:8m/ZJve3oMr6R+EJY

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
394fd2f83708d7eeac143a210162a1c7_JaffaCakes118

Files

394fd2f83708d7eeac143a210162a1c7_JaffaCakes118
.exe windows:5 windows x86 arch:x86

4c91502271eaa6998ba67d5d43b5abb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

URLDownloadToFileA

shlwapi

StrDupA

kernel32

lstrcatA
CloseHandle
lstrcpyA
ExitProcess
CreateFileA
lstrlenA
GetTickCount
WriteFile
GetVolumeInformationA
CreateProcessA
GetSystemDirectoryA
GetEnvironmentVariableA
GetTempFileNameA
GetTempPathA

user32

wsprintfA

msvcrt

memset

Sections

.text
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 756B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ