2b9a87548b8270fdfa0e791db51600dc_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2b9a87548b8270fdfa0e791db51600dc_JaffaCakes118
Size

40KB
MD5

2b9a87548b8270fdfa0e791db51600dc
SHA1

fbd944ec20297c584d7b71665110e2a8c21f5501
SHA256

55236641e6dfb87ee589a233f32905d0c9b0ad38fcf9f854033b4562b9c741d4
SHA512

6e9f378e2a94d4f6385454a49427780954963ecabe7e15074008ebc1849b0a8c94e790afd1b8df180bc85b7daeb63f49bbbcb9702a102bab8939aa111efac67a
SSDEEP

384:BtftV1ATKYGAYbA9DeTM5BfjpKsRYRYR61uKZNN6jpBu1czWo4/diM:VLtYGAYbpM5BfjcIkkqX14YdiM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b9a87548b8270fdfa0e791db51600dc_JaffaCakes118

Files

2b9a87548b8270fdfa0e791db51600dc_JaffaCakes118
.exe windows:4 windows x86 arch:x86

90e5d30c2e1e5b89fcfade9fa171572e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WinExec
GetTempPathA
OpenProcess
CloseHandle
Process32Next
TerminateProcess
Process32First
CreateToolhelp32Snapshot
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA

msvcrt

fputc
fgetc
tmpnam
??2@YAPAXI@Z
strstr
fread
fseek
fclose
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??3@YAXPAX@Z
fopen

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ