e939149856b3215cf00fab65a01643e6_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e939149856b3215cf00fab65a01643e6_JaffaCakes118
Size

110KB
MD5

e939149856b3215cf00fab65a01643e6
SHA1

bec5df38592fad9dde2eefa834ce674929355320
SHA256

56f979e7608d0d8fc8c2a3b077ebd2e5f36f1283ecaead0e7e412f2fc580087e
SHA512

0f99878a1c03979e43306d758b2a1593f9e4475feef00526a0c51277f2733050871ad3423b4382da0305e6d3a9919f1285c04fa2f1ee23780a4a7ea516d1f7c6
SSDEEP

3072:4vljFJeHgv+RzVLbLVk50RvMJNbscEiR9YjzV:4vljFJeHgv+RdLnvMJNI1/H

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e939149856b3215cf00fab65a01643e6_JaffaCakes118

Files

e939149856b3215cf00fab65a01643e6_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e19c6cb6e964352794c5b09bef347627

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
GetCurrentThreadId
GetLastError
LocalFree
GetVersionExW
HeapFree
HeapReAlloc
HeapAlloc
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetTempPathW

msvcrt

_XcptFilter
_cexit
_initterm
__wgetmainargs
log10
memset
_wtoi64
iswdigit
_controlfp
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
exit
_exit
_wcmdln
_initterm
memcpy

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ