17587cad48c37c70ca20d44873d4068f_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17587cad48c37c70ca20d44873d4068f_JaffaCakes118
Size

360KB
MD5

17587cad48c37c70ca20d44873d4068f
SHA1

39548c4266cb5d73a8309f241300825c17a49bc3
SHA256

126ebd2245698bb6fb3d3405d333154a096c2d131d9608bd3481015101559f0f
SHA512

dae91d4625c7b5bb6b0246dec91523aa55802fd91abb04308a35d4912a7770695d6cafe0927ee6b63bbe150f8a8cdc9a8ae558712dc0f0345d6f9b436fab306e
SSDEEP

6144:03ctoLU3AfFKMxnG8PJf2BQV504y8KLBy2wtsWftySDNqsGTUbgV:08QKknGcAk0/8KrXYtySDhGUbgV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17587cad48c37c70ca20d44873d4068f_JaffaCakes118

Files

17587cad48c37c70ca20d44873d4068f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6e2e3fb9d771935eaa438ef5a7c2c4fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetCommandLineW
GetTempFileNameW
FindResourceW
FreeLibrary
LoadResource
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
WriteFile
LoadLibraryW
SizeofResource
FormatMessageW
GetModuleFileNameW
CreateFileW
GetProcAddress
GlobalFree
LockResource
CloseHandle
DeleteFileW

user32

MessageBoxW

shell32

CommandLineToArgvW
DoEnvironmentSubstW

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 346KB - Virtual size: 345KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ