0c5861504dd9156b601c0db63eebaf52_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0c5861504dd9156b601c0db63eebaf52_JaffaCakes118
Size

140KB
MD5

0c5861504dd9156b601c0db63eebaf52
SHA1

6a1254a8027b7217612bfa3161a68e74b118d5a6
SHA256

58a9e1a0558d77473c4bce16f75e403f3ace83910002f8beb233f7ff7cbf5e0d
SHA512

3217bac07a7c200bce503758bf74f5e5c6817cc616ef1a15f982d9fadb25aa35d20dd70566ff63d5d96d54966e1908c15a30708b2cdead75c1077498707ff434
SSDEEP

1536:WK+NJAPod8leLLLLLLLLLLLLL4YbTBxupuHG6+/efOtNLLLLLLLLLfKotE8Bq4tR:V+NJA0JxOuHx+/efOrKo3876NCf/Xey

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c5861504dd9156b601c0db63eebaf52_JaffaCakes118

Files

0c5861504dd9156b601c0db63eebaf52_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e4510e7fce429b13a61eb2314890283e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
WriteFile
CreateFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetLastError
CreateDirectoryA
CreateProcessA
MoveFileA
DeleteFileA
GetTempFileNameA
GetTempPathA
GetModuleFileNameA
WaitForSingleObject
CreateMutexA
GetModuleHandleA
GetStartupInfoA

msvcrt

_initterm
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_vsnprintf
_beginthread
_exit
_XcptFilter
exit
_acmdln
__getmainargs
??3@YAXPAX@Z
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ