0ed9e093eef04cdb3df80e83ac9589c2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0ed9e093eef04cdb3df80e83ac9589c2_JaffaCakes118
Size

24KB
MD5

0ed9e093eef04cdb3df80e83ac9589c2
SHA1

2a17caf6cecde8c4b3a62defae9bebd172de7cbf
SHA256

85b044cb2551b8634d3fa020823e08ab9d5d788a5f4d1c811859234c36b91966
SHA512

cdd70833a47bb4ea08e69b32fdec101ec2888711a6e8807c13a4ab3319417daea8c9880bd1a80362d443b2ce26d4b6b5862832a69cf0a6ed3f175b48470744d0
SSDEEP

192:9Xv8PSMA/tqLyn2VVA8uQvnWRBmm5vUj60JuVoP1oy0+GShKQ9Z1:9XvExKtqu6RXvW/D5vRyug16Sh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ed9e093eef04cdb3df80e83ac9589c2_JaffaCakes118

Files

0ed9e093eef04cdb3df80e83ac9589c2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8c72cd3685901574988db255a51ed953

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryA
Sleep
GetWindowsDirectoryA
GetLongPathNameA
GetTempPathA
GetModuleFileNameA
CloseHandle
CreateProcessA
MoveFileA
DeleteFileA
WriteFile
CreateFileA
FreeLibrary
GetModuleHandleA
GetStartupInfoA

msvcrt

isupper
isspace
ispunct
isprint
islower
isgraph
isdigit
??3@YAXPAX@Z
atol
isxdigit
_except_handler3
rand
sprintf
srand
time
__CxxFrameHandler
_access
strstr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
ldiv
??2@YAPAXI@Z
_itoa

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ