f42a88de628903469caddf4eccb47509_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f42a88de628903469caddf4eccb47509_JaffaCakes118
Size

151KB
MD5

f42a88de628903469caddf4eccb47509
SHA1

931f6d4cf1e918e0ba655a94e50da4a54ed199fb
SHA256

14fa14a5e78802e34bd6842fe1f31780cc399cfd15edd19509d6cbfc672be85d
SHA512

04774f9846ea338f1bf3f7bc107bb4b05929b77a0042c13d47180b9f758cd134919c9e77e0a2738d86970f0803f55e4683ee6ec503ba5ecdf66b11492ab3f7af
SSDEEP

3072:SchRowKRKIvopuUBzx9cbMrqLB2FqkJSAo1FuVJZiG/Oegpm/zW7S:SOi9wUUB8bMrxpoXWiG/Oeym/ye

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f42a88de628903469caddf4eccb47509_JaffaCakes118

Files

f42a88de628903469caddf4eccb47509_JaffaCakes118
.exe windows:4 windows x86 arch:x86

094b83fd52b89f77382a973d0da48d6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

UnregisterWaitEx
GetModuleHandleA
DeleteFileA
LoadLibraryExA
EnumTimeFormatsA
GetCommandLineA
FindFirstFileA
DeleteCriticalSection
MoveFileW
GetBinaryTypeA
ExitThread
GetStartupInfoA
GetConsoleCursorInfo
GetCurrentProcessId
TransactNamedPipe
FindFirstFileExA
SetSystemTime
IsDebuggerPresent
CreateEventA

msvcrt

__setusermatherr
_initterm
_adjust_fdiv
_controlfp
_acmdln
_XcptFilter
memcpy
__getmainargs
_except_handler3
__set_app_type
exit
__p__fmode
__p__commode
_exit

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ