004e5d90c8ad717ab3a437174fd10e12_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

004e5d90c8ad717ab3a437174fd10e12_JaffaCakes118
Size

209KB
MD5

004e5d90c8ad717ab3a437174fd10e12
SHA1

a86c11f75a0e0188c3f24bf86415e6ab74c9a0b9
SHA256

2d3e917fc9e0eac59f04019ebe406a6d26ccb0b351eafcb60d9e9bbabfe62ab6
SHA512

e81ae3fb5dee4a20816ebad13ac8e8b79127bba94fc4b414097dd305a4b27151aefeed00a6a05b9531ed2f538d8c4bf61647eb22b148ce7baad24977022e55e5
SSDEEP

3072:FXJP4RehcbGGn9Q27Fd/Px7tBo68UFFmlT5ySxXnpo8b+BZEaTJyG:F1oehVe9h7f1FLVsXpx+ZE7G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
004e5d90c8ad717ab3a437174fd10e12_JaffaCakes118

Files

004e5d90c8ad717ab3a437174fd10e12_JaffaCakes118
.exe windows:1 windows x86 arch:x86

a8a85d0ae6e2ea504d2a9fd5095bf577

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsSetValue
LockResource
HeapAlloc
SetPriorityClass
SetFilePointer
GetModuleHandleA
GetStartupInfoA
lstrcmpA
InterlockedDecrement
GetStdHandle
GetCommandLineA
HeapCreate
GetConsoleCP
MultiByteToWideChar
RtlUnwind
ResetEvent
FormatMessageA
ExpandEnvironmentStringsA

msvcrt

_mbctolower
_wfindnexti64
__set_app_type
_mbsncat
__setusermatherr
_cgetws
_beep
_mbsrev
_umask
_exit
_initterm
__p__fmode
_wfopen
_controlfp
_except_handler3
__getmainargs
_XcptFilter
exit
memcpy
vprintf
_acmdln
_mbsnset
__p__commode
_adjust_fdiv
_mbsnbicmp
acos

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 195KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ