f8413472f64c28e1b07f27390c15ffc8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f8413472f64c28e1b07f27390c15ffc8_JaffaCakes118
Size

16KB
MD5

f8413472f64c28e1b07f27390c15ffc8
SHA1

5fd50e3d650c27eade72b88b7febd8afd8eeebbd
SHA256

c41ee71cb5694fb8a97c089177a6e9ce13cff7e5a09d4384665c019f888371ad
SHA512

f620d7552b3442dcac62b3245ae90217e81d50b989a33efa781df61f58b7df25d4d1650407256b156b455a3d47503c0aa4746194abaaafff49147a3a10fab608
SSDEEP

96:F3WZwNUunVnsrSmET7nPI2efdatmf9v/KRT1BI5:F39N3hUonPILa0f9v/KRT1BK

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8413472f64c28e1b07f27390c15ffc8_JaffaCakes118

Files

f8413472f64c28e1b07f27390c15ffc8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5f0699d7610927afd8e7186b66b6d76a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

urlmon

URLDownloadToFileA

msvcrt

strncmp
strncpy
_strnicmp

kernel32

GetStartupInfoA
CreateProcessA
WaitForSingleObject
DeleteFileA
IsBadReadPtr
HeapFree
GetProcessHeap
GetModuleHandleA
ExitProcess
HeapAlloc
CloseHandle

user32

MessageBoxA
wsprintfA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 686B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE