32b54d4f01054d9f193664b7b5772f94_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

32b54d4f01054d9f193664b7b5772f94_JaffaCakes118
Size

74KB
MD5

32b54d4f01054d9f193664b7b5772f94
SHA1

d68bd6e5f121c720b13d8c34ece28eec4a4478b6
SHA256

e0418413a0775d659c0a47350df4fa00157d6aaa928ce8583deba90f2aa4d830
SHA512

410cf332302713fb18b11a6117ee38ed6d27a9c1e81b79bd0ff8c819b1a52d9274f255a274d812cb1216e3ff552f20d8d853155aba4f4f4fa44d33a44aaba197
SSDEEP

768:Nn3SBAdJ22b2xpj3wnyaX6+RjUuQdTn9cHdx/s6hA9LoYlxtDUltEfG3NnALMAEg:lSBAbp28LbdRMHlxBbMAlUg9b8u

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32b54d4f01054d9f193664b7b5772f94_JaffaCakes118

Files

32b54d4f01054d9f193664b7b5772f94_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd211e2c83c9b4642c33fed8c81b90d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strncmp
strchr
sprintf
_itoa
_chkstk
atoi
strstr
strncpy
memset
RtlRandom

kernel32

lstrcpynA
VirtualFree
VirtualAlloc
OpenProcess
SetCurrentDirectoryA
GetTimeZoneInformation
GetCurrentProcessId
GetWindowsDirectoryA
GetSystemDirectoryA
ReadFile
Sleep
CloseHandle
WriteFile
SetFilePointer
CreateFileA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetProcessHeap
GetSystemTime
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetLastError
GetLocalTime
GetCurrentDirectoryA

psapi

GetModuleFileNameExA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE