3d8f189ea2ff0835119429203c625877_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3d8f189ea2ff0835119429203c625877_JaffaCakes118
Size

31KB
MD5

3d8f189ea2ff0835119429203c625877
SHA1

88aa23776f448977665dac81c4654f221ac220aa
SHA256

cb20d1eafa6ebaf85f0da00b02848062e04a958944f8c1a25648847a748f0f45
SHA512

4da4d7dd5822e2fde7036d031095ca20be60ebd9b388b08069d7b83fc9573eda21cd303f9e14bad0bf0591066eb3ae215bd8357723a2e15fa541cb925e0e7cba
SSDEEP

768:0XGtq82Kc9t6PfTEAMBMETsw4q+jDqejnT/6l3shP8OX7h:0XWqeE0myEAwwqejTyit8O1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d8f189ea2ff0835119429203c625877_JaffaCakes118

Files

3d8f189ea2ff0835119429203c625877_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c7d9215b93beeb75911ff290232c30e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
time
_exit
_XcptFilter
exit
rand
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strcpy
strlen
_except_handler3
strcat
atoi
mbstowcs
memset
??2@YAPAXI@Z
_acmdln
??3@YAXPAX@Z
_stricmp
_stat

kernel32

GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
OpenEventA
SetEvent
CloseHandle
GetLastError
GetStartupInfoA

user32

wsprintfA
MessageBoxA

ntdll

ZwFreeVirtualMemory
ZwQuerySystemInformation
ZwDuplicateObject
ZwOpenProcess
RtlAdjustPrivilege
ZwQueryInformationProcess
ZwClose
ZwAllocateVirtualMemory

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ