20bdd744f88177cc9f8cae6379ddc241_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

20bdd744f88177cc9f8cae6379ddc241_JaffaCakes118
Size

918KB
MD5

20bdd744f88177cc9f8cae6379ddc241
SHA1

5fb65cb433fe4c846b0c552e170fd57ea0de9099
SHA256

fa1d94418144a75ba889c4ec7053706fd50411480f9c8b329b37494f01b80908
SHA512

57f00cea95040e854649c9d58ad0b79308b5274789109e9cb7c0dc3e5f80669e0e5ed2724995edeb96804dcb50b8a8fdfd7cba4cc1c569b6acd6da8532c2eec3
SSDEEP

24576:1mB4b7CjY2P6sQG5Th9MfDj/DpTfv6hcVerH6U:pyPnQ+m3cyvU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20bdd744f88177cc9f8cae6379ddc241_JaffaCakes118

Files

20bdd744f88177cc9f8cae6379ddc241_JaffaCakes118
.exe windows:4 windows x86 arch:x86

53b338a5a343440770be2403e59415fb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
HeapDestroy
HeapFree
QueryPerformanceCounter
Sleep
HeapCreate
HeapAlloc
GetProcessHeap
ExitProcess
GetModuleFileNameA
GetTickCount
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
WriteFile
GetLastError
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
CloseHandle

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE