a65a82ed88abf5947bb05be0d94a7bd3_JaffaCakes118 | Triage

Sharing

General

Target

a65a82ed88abf5947bb05be0d94a7bd3_JaffaCakes118
Size

172KB
MD5

a65a82ed88abf5947bb05be0d94a7bd3
SHA1

8f26d74d6c7a1de127a5e75345923f7c9228d1e3
SHA256

6d7016ecfc5bf9d99739b073b7e117e064e3522ba3e92951259db073ab235e1b
SHA512

3605c24b9d94802a47c95bb8279dcf3dae2fb7297eca1a72bad4a7faf8b6c3b61a8c5b7a2408eec5303cc4c221f7f08acaf5494f8a0a60a5fc1b15648e15e147
SSDEEP

3072:uN+4BFpqVID5fAxjaRD7jFfW0w9ZFbDYbT91VsCKtLRPHqWdyKLM7wR:uU4hjVvdXFfuZRDY3VstPH9dk7wR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a65a82ed88abf5947bb05be0d94a7bd3_JaffaCakes118

Files

a65a82ed88abf5947bb05be0d94a7bd3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0a046b6faabbc611e3ffd4a8e35d0fbd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

CM_Get_Depth_Ex
SetupDiGetDeviceRegistryPropertyA
CMP_WaitNoPendingInstallEvents
CM_Get_DevNode_Status

shlwapi

PathAddBackslashW

kernel32

InterlockedDecrement
SetLastError
TlsSetValue
TlsFree
AddAtomW
GetModuleHandleA
CreateFileA
GetTempPathW
WriteConsoleW
CreateFileW
CreateFileMappingA
GetConsoleCP
GetProcessHeap
LoadLibraryExW
EnumResourceNamesA
GetConsoleMode
UnmapViewOfFile
GetProcAddress
MapViewOfFile
GetLastError
GetVersionExA
TlsAlloc
InterlockedIncrement
IsBadStringPtrW
GetModuleHandleW
ExitProcess
TlsGetValue
HeapFree
FlushFileBuffers
HeapAlloc
GetVersionExW
GetEnvironmentVariableW
Sleep

winmm

mciSendCommandW
sndPlaySoundW

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ