e25040d2f507a5cf6ce702ae74535093_JaffaCakes118 | Triage

Sharing

General

Target

e25040d2f507a5cf6ce702ae74535093_JaffaCakes118
Size

169KB
MD5

e25040d2f507a5cf6ce702ae74535093
SHA1

1cf1094b7f4930637319055fd67e4554a5d75e6f
SHA256

e8bbbdfc5b1394c1fa5d1c911fc1ae9011bef5530f1ee235762561a05ebf9ff6
SHA512

837641184f6eef1d216fbad233daa51db4d0b9fbd2ad19da027b8c7a2901c8b8a477ad7d75fc95ab3ff2b2eb591583e3edac64169d83b498f919d4d27ecd40a4
SSDEEP

1536:7U6Wm9vrVLaoZ5BebM7HGBEe95N8vC/ku292XJfInHLQtAPj4ejuJDCrGi3lbd93:7JZdTUbMaIDcFCHLQtAcBWGAbdO9w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e25040d2f507a5cf6ce702ae74535093_JaffaCakes118

Files

e25040d2f507a5cf6ce702ae74535093_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE