3a3aad852a608e51303f8e6d5884358d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3a3aad852a608e51303f8e6d5884358d_JaffaCakes118
Size

15KB
MD5

3a3aad852a608e51303f8e6d5884358d
SHA1

ecef937e7edb4bf3764e1a9135e402f3269b2e98
SHA256

6a41f3b9698878179e6edd5033eb823763614e250eed5f0b82ed9f68bdf5e3a3
SHA512

bc7aa8d360d30337430961a56e826d692cd19faa33eccc031b7b6770d7af7ac07daa3250114bfbd1e96f2bb78537d798f21fb14353dcc48923a9086ea7e142df
SSDEEP

384:LRNoVwkBagv5CO7MBzOTN1adWQ5fKURrYNQXkAp5:4BXMO7qzAfISAkAp5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a3aad852a608e51303f8e6d5884358d_JaffaCakes118

Files

3a3aad852a608e51303f8e6d5884358d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd241e96f287ecc37cbfb4b8acd15ecd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

MessageBoxA
GetMessageA
wsprintfA

kernel32

GetTempPathA
lstrcpynA
lstrcpyA
lstrcmpiA
CloseHandle
CreateFileA
CreateProcessA
ExitProcess
FindResourceA
FreeLibrary
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetStartupInfoA
LoadLibraryA
LoadResource
LockResource
RtlZeroMemory
SetLastError
SizeofResource
Sleep
WriteFile
lstrcatA

Sections

.text
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 978B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ