1b949bb52e8f1c9abdb2b2e4d4cc3479_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1b949bb52e8f1c9abdb2b2e4d4cc3479_JaffaCakes118
Size

126KB
MD5

1b949bb52e8f1c9abdb2b2e4d4cc3479
SHA1

0aaeab6be7cb17cfea57a60746298528277bd0cb
SHA256

bbc9fd76883288e7c6374b99d5ff727dc9f275fd5b3d7ebae8d82bd63bc3ce84
SHA512

279c6d5d3476a4e0c3cbecd3bff5ad0eb73d19936511254defc3caa5eff3659e5017b90ceb12f67cc7ae226d0603a03e565a8200b489e6769493a21ed1e6c0bf
SSDEEP

3072:Cb54WNoL7ay1tqlGctf3IrlgBOZSBx15PgJ1qj:Cb5st1tqXB3ZOZoj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b949bb52e8f1c9abdb2b2e4d4cc3479_JaffaCakes118

Files

1b949bb52e8f1c9abdb2b2e4d4cc3479_JaffaCakes118
.exe windows:1 windows x86 arch:x86

8121e7b5b97542ef0bae31d30a447c0a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind

user32

MessageBoxA

crtdll

_getch
_iob
_itoa
__GetMainArgs
_stricmp
_strnicmp
toupper
abort
exit
ferror
fgetc
fputc
fwrite
localeconv
memcpy
memmove
memset
pow
raise
signal
strcat
strchr
strcmp
strtol
ungetc
wcslen
wctomb

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 664B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 924B - Virtual size: 924B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE