3d1775323e542c54f47b41f2879f7224_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3d1775323e542c54f47b41f2879f7224_JaffaCakes118
Size

144KB
MD5

3d1775323e542c54f47b41f2879f7224
SHA1

a3fb90d3f919e813f4d78aeed8660e359b11979a
SHA256

27c711f8c33d37ac021d9365819a8dfc70a55bb24e0af4bfe57331c1b9cb5d89
SHA512

a4d3e39619ddfc8bc25107da68739eb4d8f89f443ff8e1a2803c8ddd56e3e3df1ca46b6c7db3cbc3ec21eae3b27dcddb1401a9b7b60e45f131c3d043ff83d684
SSDEEP

3072:LBUkmAx2g7OyKA4aCnqZE+lOair++gnyZY3qFB:LoATw+li6Pybr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d1775323e542c54f47b41f2879f7224_JaffaCakes118

Files

3d1775323e542c54f47b41f2879f7224_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1c965e1ea355bcedfee10da7df49ac2d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__getmainargs
memcpy
__p__fmode
__setusermatherr
strtol
__p__commode
_XcptFilter
_safe_fprem1
memcmp
_initterm
_exit
exit
_vscwprintf
_tempnam
_except_handler3
_controlfp
__set_app_type
_acmdln
_adjust_fdiv
_outp

kernel32

LoadResource
CreateThread
lstrcatA
GetLastError
GetStartupInfoA
GetModuleHandleA
InterlockedDecrement
HeapAlloc
HeapCreate
SetUnhandledExceptionFilter
GetEnvironmentStringsW
InitializeCriticalSection
HeapFree
IsBadReadPtr

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ