fc859022ea7ceac7402b7381c7255123_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fc859022ea7ceac7402b7381c7255123_JaffaCakes118
Size

55KB
MD5

fc859022ea7ceac7402b7381c7255123
SHA1

2892dc7e63e4318cd6024f6e52514a4c37adfab9
SHA256

8b51235dbe1bcdc8389a23096709236d70344d98a4d5b286af593aafaf863363
SHA512

a8f2191b1de6fac2f7031a09140e9d7348d70476533609c26b26bd821cc971d72b0e0320ede6412eec8b7f8b8d282db7af56e23abe7443a63f1de08008691a48
SSDEEP

1536:s6CZ/WJK4smw7qnNPmJWV4UNYb5+q/h59q8f1KDEt8qD:VugK4smw7ENL2UOd+qHJfsDE5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc859022ea7ceac7402b7381c7255123_JaffaCakes118

Files

fc859022ea7ceac7402b7381c7255123_JaffaCakes118
.exe windows:4 windows x86 arch:x86

fdfd59f575e4d6a135182a3d5c60e6d2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalUnlock
GetEnvironmentStrings
ReplaceFileW
IsBadStringPtrW
RegisterWaitForSingleObjectEx
CreateThread
GetStringTypeExA
SetConsoleIcon
VirtualQuery
ReleaseMutex
GlobalAddAtomA
lstrcpyn
GlobalWire
OpenJobObjectA
LoadModule
QueryDosDeviceA
GetCommandLineA
ExitProcess
GetStartupInfoA

Sections

.text
Size: 5KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE