46427712e9db62054750f563932f2797_JaffaCakes118 | Triage

Sharing

General

Target

46427712e9db62054750f563932f2797_JaffaCakes118
Size

7KB
MD5

46427712e9db62054750f563932f2797
SHA1

62fb1d866dd7d41a852110843c76883bfb0a201d
SHA256

1e2ece766c4949e794422ff3b7b966d702f1008dc579ad0be6613b8fac173221
SHA512

7587e875b8b82931f91247eb66b6c86c3536ec8d69b4a0960ba955c8d30cde53afcf65a7fa7d7583c28e7f617b48f15eac3c22399c065eda6689442ddd42a760
SSDEEP

96:pwf5Mm08sf7D9/2GPzLQ/p55peKdcd0hSl+H/tLrd28d9dM3uWaDLeBomjFCz:G2mrsfN/JrLQhvpxlflrsK6aDLI/FCz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46427712e9db62054750f563932f2797_JaffaCakes118

Files

46427712e9db62054750f563932f2797_JaffaCakes118
.exe windows:4 windows x86 arch:x86

957599e9f83645134fb3647f0597eaa3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetPrivateProfileSectionNamesA
Sleep
WritePrivateProfileStringA
lstrcatA
lstrlenA
ExitProcess
GetProcessHeap
HeapAlloc
lstrcpyA
HeapFree
GetVersionExA
lstrcmpiA

user32

wsprintfA
GetDesktopWindow

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA

shell32

ShellExecuteA
SHGetSpecialFolderPathA

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.RPCrypt
Size: 172B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ