187121c4f73691d451500a4909a0c994_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

187121c4f73691d451500a4909a0c994_JaffaCakes118
Size

517KB
MD5

187121c4f73691d451500a4909a0c994
SHA1

0b92e1da213ad402e8ae6eb83939bb8d6534c041
SHA256

4971c84c1ff9effcad34692800e6003a1f7dc90c190e198f7ff729f2fbd4b598
SHA512

9a17fc201610a47db067dbfc4935eb77e3bef69fecea6ff8961d5b16ae665f6932c37e4ce52c1bc69b9ae6246efc3aaf187500580e71321e7e74f6909befed6d
SSDEEP

6144:2EWKHXf55lnA3Js5Km6CjySyNYH60Ji52dQKr1LF8KJ1BijeF6vftOzt5X5JJjo7:2MPlG21mYa0X1p0eFItO7hIFH+4KFn6r

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
187121c4f73691d451500a4909a0c994_JaffaCakes118

Files

187121c4f73691d451500a4909a0c994_JaffaCakes118
.exe windows:4 windows x86 arch:x86

37396b9573ec54189b4bc14b337b26ec

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
SetThreadContext
GetThreadContext
WriteProcessMemory
VirtualAllocEx
CreateProcessA
GetProcAddress
GetModuleHandleA
LockResource
LoadResource
SizeofResource
FindResourceA
GetModuleFileNameA
GetStartupInfoA

msvcrt

_exit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 778B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ