228d897270678e0a05655422fca68698_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

228d897270678e0a05655422fca68698_JaffaCakes118
Size

16KB
MD5

228d897270678e0a05655422fca68698
SHA1

bdabf593ad12cc0a68b80d9df2250ddafe40dc6e
SHA256

715b4725f2799d6e6920589783cf77fb04ad6f614478293665fc38162eabc200
SHA512

31340d4f40f1783e1e3bfd4acd1bb35f2204a26c03d2041f69a8d487e6a5659321f9a2d3a8d1c3b502da8910c060cb8ca3e6c79ccd4d4ee55b189c2f43529f91
SSDEEP

192:jIA4CJwTQeIzDneiW7FqIEKPYVUNJLvXZFgeroC4V:cnCJwMF6iWwIqUzLBqerfi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
228d897270678e0a05655422fca68698_JaffaCakes118

Files

228d897270678e0a05655422fca68698_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1470a0ba50e09d10917bc409c9f0af94

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
SetUnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
free
fwrite
malloc
memcpy
memset
signal
vfprintf

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 196B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE