237c326e6664174db79d842f0869a57c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

237c326e6664174db79d842f0869a57c_JaffaCakes118
Size

16KB
MD5

237c326e6664174db79d842f0869a57c
SHA1

0f5453017924b624f4fcdc43686013eaa18c8903
SHA256

b64685d6094549fe7b72ddb7e909b281b61024d8457d946b8cfe98541ef0b357
SHA512

f72576c68806a5dca55a3b9e87f0660574d7cce1b3d587ae2ea32243bd26e701ed5e582ca26911ba49c48b394cb552c2d32d14a6aba61bfe48726ea1d551b595
SSDEEP

96:Sl2w0pJrJr1JktX9qj16NG3yXb3eon/yLbkxuHPtboynuv:vVr7ktX9qUCu7eNP1oynuv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
237c326e6664174db79d842f0869a57c_JaffaCakes118

Files

237c326e6664174db79d842f0869a57c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4206db33fe324b207efbd58f721d2f7c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA

msvcrt

exit
_acmdln
__getmainargs
_initterm
_XcptFilter
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
strstr
strchr
strrchr
memset
strcpy
fopen
strlen
toupper
fprintf
fclose
strcat
__setusermatherr

kernel32

GetStartupInfoA
GetModuleHandleA
SetCurrentDirectoryA
CreateProcessA
CloseHandle
GetFileTime
SetFileTime
GetFileAttributesA
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
GetWindowsDirectoryA
SetFileAttributesA
CopyFileA
GetModuleFileNameA
CreateFileA

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE