2f887658bc17e338f387d2629a8a2c92_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f887658bc17e338f387d2629a8a2c92_JaffaCakes118
Size

216KB
MD5

2f887658bc17e338f387d2629a8a2c92
SHA1

8ac027f109714d89a01b29cc9332eef2931d90f0
SHA256

45f327befab61c2360eaec16abe46f8ccb61faee45511eb53fccd81b27981b5f
SHA512

d7b8d79f283140386f3cf715dabe0ea3ec9efd64601b99fefeb2e86221422524f1931f0a482c88d5effb9d15074514164e544b002c3f82340670e4d0445e74d9
SSDEEP

3072:tvHICKNXLZFhq8CBv8BzGhitBQYCGu+5sB/7tWk:tfcRLZnq8CSBo4BQYCvRv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f887658bc17e338f387d2629a8a2c92_JaffaCakes118

Files

2f887658bc17e338f387d2629a8a2c92_JaffaCakes118
.exe windows:1 windows x86 arch:x86

3ea0c29a68f81f35af225cbeeae4114f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadReadPtr
GetSystemDirectoryA
GetStartupInfoA
CreateEventW
WriteFile
HeapAlloc
GetLastError
CreateProcessA
Module32Next
DeviceIoControl
GetCurrentThread
GetModuleHandleA
GetFileTime
lstrlenA
VirtualAlloc
LocalFree
HeapCreate

msvcrt

_ismbckata
exit
_acmdln
__getmainargs
_ismbblead
is_wctype
__p__fmode
_findfirsti64
_initterm
__setusermatherr
_exit
_XcptFilter
_adjust_fdiv
vsprintf
_rmtmp
longjmp
_controlfp
_mbctoupper
_ismbbkalnum
__set_app_type
_chmod
_except_handler3
__p__commode
_getw
memcpy
_mbsnbcoll
_memicmp
_fgetwchar

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 158B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ