3c3a90949e10184400c638b9d8243a5e_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3c3a90949e10184400c638b9d8243a5e_JaffaCakes118
Size

48KB
MD5

3c3a90949e10184400c638b9d8243a5e
SHA1

7bb53feb7a08350a507cd2ff20b57e3a5d9b90c9
SHA256

3ad845ec448f3ce170cb4712435f72633ecaea511a642ec5e1f6aa9a599372ae
SHA512

2f20a80614443c2fd2a1748f6d56b6673023b1d714b977dd469a8f94e9042c02bdc514739ce4271b4dedfb4f51fad75071810219785726876d358c9726bfea4c
SSDEEP

768:nsSnMq7m0C6oZNp2lQZVV46DD+pYZ4VGa4dHvpMBkT9BGSG3mwRNnTewuKYchR:BMqqNZ5PX+eZ4VGa4dHB+kTfmNLn6wu6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c3a90949e10184400c638b9d8243a5e_JaffaCakes118

Files

3c3a90949e10184400c638b9d8243a5e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

27fb29c17db97b08b2aadf8700305e85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
CreateThread
DebugBreak
DeviceIoControl
ExitProcess
GetCurrentDirectoryA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetThreadContext
GetTickCount
GetVersionExA
CopyFileA
LockResource
QueryDosDeviceA
ReadFile
ReadFileEx
ReadProcessMemory
SetCurrentDirectoryA
SetEndOfFile
SetVolumeLabelA
Sleep
UpdateResourceA
VirtualAlloc
VirtualFree
VirtualProtect
WriteConsoleA
WriteFile
IsDebuggerPresent
CloseHandle

wsock32

gethostbyname
WSACleanup
WSAStartup

user32

MoveWindow
CloseWindow
GetTopWindow
GetWindow
GetWindowRect
GetWindowTextA
IsWindowVisible

gdi32

GetColorSpace

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE