33eaea509929b6a17f9b0025331b5e5c_JaffaCakes118 | Triage

Sharing

General

Target

33eaea509929b6a17f9b0025331b5e5c_JaffaCakes118
Size

97KB
MD5

33eaea509929b6a17f9b0025331b5e5c
SHA1

c9fd2d2e49c7035e9a7d60a425d195eb93b3608e
SHA256

7d629d09c4dbde5764d04aefac93d5c6afbe7971408a3393705c8fe8d0ecbd41
SHA512

fabbbc4b16a9153cd4588c66d1ac17ae4937a2e82c5d6a8940b36c766ed142924724d99c3b9adf4a813febdb016c1460729808896b8db7509b2add048d6be2e7
SSDEEP

1536:lOXmHPzYVbfYRJJ6UkC9eDRhH62nzvUU9NcHh9:Ii9epUiNS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33eaea509929b6a17f9b0025331b5e5c_JaffaCakes118

Files

33eaea509929b6a17f9b0025331b5e5c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0b9338b9562c4b0faee7417fba6636f0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
GetModuleHandleW
Sleep
GetLastError
MoveFileW
GetSystemTimeAsFileTime
DeleteFileW
lstrcpyW
lstrlenW
GetEnvironmentVariableW
lstrcmpA
lstrlenA
UnmapViewOfFile
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
SetLastError
LoadLibraryA
LoadLibraryExA
lstrcatA
lstrcpyA
GetModuleFileNameA
GetProcAddress
HeapFree
FreeLibrary
HeapAlloc
GetProcessHeap
LoadLibraryW
LoadLibraryExW
lstrcatW
ReadFile
SetFilePointer
ExitProcess
FormatMessageA
GetCurrentProcess
MapViewOfFileEx
CloseHandle
MapViewOfFile
CreateFileMappingW
SetEnvironmentVariableW
GetFileSize
CreateFileW
WideCharToMultiByte
lstrcpynW

user32

MessageBoxA
wsprintfW

ntdll

LdrLoadDll
NtProtectVirtualMemory
LdrGetProcedureAddress

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.res
Size: 288KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ