40a1780c1f65df1f99cdd1362a81b880_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

40a1780c1f65df1f99cdd1362a81b880_JaffaCakes118
Size

128KB
MD5

40a1780c1f65df1f99cdd1362a81b880
SHA1

5b9d9406f3e41c7c2096d0d238689713746aa2b9
SHA256

4f35f72d1561ad1f4a1c56cab1afcce88ce8cbef29d93337777f74e83550760e
SHA512

0c37d76dd6ff25f7a136f8296f696a6cae71b1914c4662e542d65a1347c8beddf3d61f6dbd732de920f556b723bdb23fa623ae5817baf61cca46a78d609599ba
SSDEEP

1536:nPBMwyrZ6f6uTla4rUypZdG6wRGzPofa3bFy6djFXFwdq30fK89M1eNjmjcHEeGG:nR00iMadEZdKIofa3TFX+79WjqL6yz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40a1780c1f65df1f99cdd1362a81b880_JaffaCakes118

Files

40a1780c1f65df1f99cdd1362a81b880_JaffaCakes118
.exe windows:5 windows x86 arch:x86

05c1de7b4da5051b106e3df49bc95721

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrcmpA
Sleep
CreateDirectoryA
GetDiskFreeSpaceW
HeapCreate
FindResourceW
GetPrivateProfileIntA
LoadLibraryA
WriteFileEx
lstrcpyW
GetExitCodeProcess
InterlockedIncrement
GetPrivateProfileSectionA
InterlockedDecrement
GetLongPathNameW
LoadLibraryExA
WaitForSingleObject
GetPrivateProfileIntA
GetFileAttributesA
GetDiskFreeSpaceW
SetEnvironmentVariableA
Sleep

apphelp

SdbDeletePermLayerKeys
AllowPermLayer
ApphelpCheckExe
ApphelpCheckIME

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rss
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ