16744880f55ca6192655ade1d307e6cf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

16744880f55ca6192655ade1d307e6cf_JaffaCakes118
Size

192KB
MD5

16744880f55ca6192655ade1d307e6cf
SHA1

f607c7342fc77238c031c3751250a4f14eb5b6b8
SHA256

5b731c8da0c7e32bd8b051fa12a548428b7f8c559f41fe62aa630d5a1808b235
SHA512

5d2d53f7c40bbf6fb03fdac536bbd0ed19d21f8d1e2f96edc6c4863cca43b812d7e8093b1d5d643c59e21250cc3fbdc4209d2f4ef134eb613ca2a0a278d8f211
SSDEEP

3072:eP9t3x6W9UWeAwNffwveMIBKAeDEdeAyDoj9hqGBJIGDHM8aGXR6RxoGnAn+g+0Q:gtF3eAwNfoP9JdAajGXo8dXR6Bpg5G/W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16744880f55ca6192655ade1d307e6cf_JaffaCakes118

Files

16744880f55ca6192655ade1d307e6cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5e7ec89d69b11ee82e25b8c8aecd2ca7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStartupInfoA
lstrcpyA
InterlockedExchange
ExitProcess
GetWindowsDirectoryA
HeapSize
GetFileInformationByHandle
GetCommandLineA
GetCurrentProcessId
GetCurrentThread
WriteConsoleInputA
SetConsolePalette
IsDebuggerPresent
GetSystemRegistryQuota
GetPrivateProfileStructA
CreateWaitableTimerA
GetCommandLineA
DeviceIoControl
GetProcessHandleCount
CancelTimerQueueTimer
VirtualAlloc
GetCommandLineA
DeviceIoControl
GetEnvironmentVariableA
CreateEventA
ReleaseSemaphore
BeginUpdateResourceA
WriteConsoleOutputA

ws2_32

send

Sections

.itext
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 160KB - Virtual size: 815KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ