fccda22e35d1175e8c00bd92e9d93801_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fccda22e35d1175e8c00bd92e9d93801_JaffaCakes118
Size

9.3MB
MD5

fccda22e35d1175e8c00bd92e9d93801
SHA1

b0036c146268c7e36a3bee8372c06572e08ce634
SHA256

e3686607bcaf9960eb413dc13c871307a00753f48bce3fdb42086c6a691ddbec
SHA512

304e69f3eaa306d5c7ff5af6aae2bd0f4f3e425cb82fb42747c67ab5008bdb238fa40c997e052141cfc09ce51b51d63dd00c5a6bcd93c1f376db36b95757049c
SSDEEP

196608:fjbZQvF3vdQ3owMY57lr985Pulpl9iy7+zj9laUPTToe:fjbOVzz

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fccda22e35d1175e8c00bd92e9d93801_JaffaCakes118

Files

fccda22e35d1175e8c00bd92e9d93801_JaffaCakes118
.exe windows:5 windows x86 arch:x86

0b9338b9562c4b0faee7417fba6636f0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
ExitProcess
FormatMessageA
GetCurrentProcess
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

ntdll

LdrLoadDll
NtProtectVirtualMemory
LdrGetProcedureAddress

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ