437d0923fb1dcd9a2dbe9e1829e228c8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

437d0923fb1dcd9a2dbe9e1829e228c8_JaffaCakes118
Size

51KB
MD5

437d0923fb1dcd9a2dbe9e1829e228c8
SHA1

48b5f48428c0f1de424cea5c5fe20f52e84e7eb3
SHA256

a17266f72ced494f108d872c363755c4d8c7b5e2bafa87c1e0458f365b3411c7
SHA512

01212ae045430bfbb7a15acd73e1d489868451b49d0bec434a2a0412135a59787becbbec450cb2c8b32752044b31b6bfe0089867b0456d185e8cba3db73f870b
SSDEEP

1536:ztkcPIedAxWFehT15OJsx1brs8DVnP+HWry+iji7O6:JkedACGT15vx1b5+2njq6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
437d0923fb1dcd9a2dbe9e1829e228c8_JaffaCakes118

Files

437d0923fb1dcd9a2dbe9e1829e228c8_JaffaCakes118
.exe windows:5 windows x86 arch:x86

acb7bf4b78f7d8d949404d9ed99be563

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

nss3

PR_Now

vcruntime140

memcpy

api-ms-win-crt-stdio-l1-1-0

puts

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-runtime-l1-1-0

exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.MPRESS1
Size: 46KB - Virtual size: 236KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE