480a909c199afc8831d2330551f2a5d8_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

480a909c199afc8831d2330551f2a5d8_JaffaCakes118
Size

1.9MB
MD5

480a909c199afc8831d2330551f2a5d8
SHA1

74bd8b08c7fde55abb327acda17657c8be807af2
SHA256

f4c2500e56366055f93e4d97560d9eb8786ce4889572a14effad60cf4cfc6732
SHA512

013819f079b8fb2be48fd8635b1756ad4650e5635ca79939d4eaa5e57fd0d9a2b24462f4770369c95772349512e68809d473453d5717c7a6e0cc38b978d98367
SSDEEP

49152:ElbUpR7vM+3rYhvv3HmpkVOJ+I8itGmTCLrpLHV9P0JR:ElgR7EEclMkV15MTYr1HPPIR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
480a909c199afc8831d2330551f2a5d8_JaffaCakes118

Files

480a909c199afc8831d2330551f2a5d8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e3d3d878cdc419f5c8f14d8a87d9ca65

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
ExitProcess
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
VirtualFree
CloseHandle
WriteFile
CreateFileA
lstrlenA
GetTempPathA
lstrcpyA
SetFilePointer
VirtualAlloc
GetModuleFileNameA
InterlockedIncrement

user32

SetCursor
LoadCursorA
wsprintfA
ShowWindow
FindWindowA
MessageBoxA

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ