3b5e6dd9884be5299414cb4cc6669f23_JaffaCakes118 | Triage

Sharing

General

Target

3b5e6dd9884be5299414cb4cc6669f23_JaffaCakes118
Size

303KB
MD5

3b5e6dd9884be5299414cb4cc6669f23
SHA1

7b1a2c8aa2f1a165c33a4d56883b77285af8442c
SHA256

37e0ecd28659f60d3e470477a0a103c21fe0178c39aad153d5a72d530bb0fee1
SHA512

bb8c955680e5a38603374dea7a554e50d69f38680aca1e428ef5e0cde8d3b60033f895a74a6acb2d4a0408d35f11d4674f1ec659ab63c658c02cac877c819004
SSDEEP

6144:dH9q36OOIfvkvQ4YUsOpueDylGP/t0Oq3wLzJmGByL:x9y6Ob8Yzgyl2/SwLBU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b5e6dd9884be5299414cb4cc6669f23_JaffaCakes118

Files

3b5e6dd9884be5299414cb4cc6669f23_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2ef256652961fef3123a1f328f2c84c3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareStringA
LoadLibraryA
GetACP
GetTickCount
VirtualProtect
GetSystemTimeAsFileTime
GetFileType
IsDebuggerPresent
TlsGetValue
WriteFile
CreateThread
VirtualFree
LocalFree
GetVersion
GetConsoleMode
LCMapStringW
SizeofResource
GetLastError
ExitProcess
VirtualAlloc
GetStartupInfoA
GetModuleHandleA

msvcrt

exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_strcmpi

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 294KB - Virtual size: 293KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ