173f9ec6092e29448a11610a98c09920_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

173f9ec6092e29448a11610a98c09920_JaffaCakes118
Size

42KB
MD5

173f9ec6092e29448a11610a98c09920
SHA1

dc36bdd40aef96293e313a33a89d11c6f0aff4e7
SHA256

3220710cc801e022254c6f05acad738061d91e8afa4b19a158b2bea5804f00d1
SHA512

4b9e4355ba295ec30be1a10023391f97aae3c0c9cd365e65ea9949778e6e4abd77800b4e860314d6175d6fe91f7a97ffb9f7abb00ac0ce937edbc8d1cd27ac06
SSDEEP

768:8XKcnEDaWcYzTBmnrK4YdRPQPhyqV62/Sya/awwZzpfn1WjLc2IxHUw0mQMGyx:8XKPaWcSRPs/lWabnv0jfmH3Gyx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
173f9ec6092e29448a11610a98c09920_JaffaCakes118

Files

173f9ec6092e29448a11610a98c09920_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1dd1dae4ac1587e65751a9615ebc7fe5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

cygwin1

__assert
__errno
__getreent
__main
__mb_cur_max
_ctype_
_exit
_impure_ptr
_mknod32
_stat64
abort
atexit
calloc
cygwin_internal
dll_crt0__FP11per_process
exit
fclose
fflush
fprintf
fputs
free
getenv
iswprint
malloc
mbrtowc
mbsinit
memcpy
memset
mkfifo
printf
putc_unlocked
realloc
setlocale
strchr
strcmp
strerror_r
strlen
strncmp
strtoumax
umask
vfprintf

cygintl-8

libintl_bindtextdomain
libintl_gettext
libintl_textdomain

kernel32

GetModuleHandleA

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 560B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE