f80cc31f98392da88004b3ba499d8a06_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f80cc31f98392da88004b3ba499d8a06_JaffaCakes118
Size

350KB
MD5

f80cc31f98392da88004b3ba499d8a06
SHA1

a92a84e620bc9675d8364504935067c555e91ff7
SHA256

982f08003e998f477cf71ef138f86f6c7cb6df4182caafdec7e7d3809e9a6a9a
SHA512

cbfba9e238c60f39c5ed002778c9ade8684c5e0e385ae18d21e0c4ea2a4223286c7c4bc7ace7ac9e79152c985680c42f3f3083af61866937af670c1ee58d7aec
SSDEEP

6144:Mtm0GJyBL2QE+u6uraIqyugzFJ2HZhr2gIO6CdmRM98IMhjSLOSQIo/C/nU:MtmfSuUgzFJ2HbrylM98LjYQQ/n

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f80cc31f98392da88004b3ba499d8a06_JaffaCakes118

Files

f80cc31f98392da88004b3ba499d8a06_JaffaCakes118
.exe windows:4 windows x86 arch:x86

89c953b20568e1864f5f00881c2602fe

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_stricmp
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_makepath
_wmakepath
wcscmp
wcscpy

kernel32

GetCurrentThreadId
LockResource
LoadResource
CompareStringA
FindResourceA
LocalAlloc
LocalFree
CreateFileA
lstrcmpA
GetFileAttributesA
GetProcAddress
GetModuleFileNameA
GetTempPathA
DeleteFileA
CloseHandle
GetCurrentDirectoryA
GetLocalTime
FindClose
FindNextFileA
FindFirstFileA
EnumResourceLanguagesA

oleaut32

SafeArrayDestroyDescriptor
SafeArrayDestroyDescriptor
VarFormatDateTime
CreateErrorInfo
OleLoadPictureEx
GetErrorInfo
SetErrorInfo
GetActiveObject
VariantInit
SysFreeString

msimg32

TransparentBlt

Sections

.text
Size: 215KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE