40c06f477aba8fc530697320715ba6da_JaffaCakes118 | Triage

Sharing

General

Target

40c06f477aba8fc530697320715ba6da_JaffaCakes118
Size

68KB
MD5

40c06f477aba8fc530697320715ba6da
SHA1

42a6fe8177a0b6f76f7a7e795ace13b4b7c00aa9
SHA256

a20e1311bd97ecc4e6f9d1c36395cbe48d745a7eee99d4001b2b46b4328c631b
SHA512

2d8885e23218f9e31be938d6b980d2c6481aa70bcd87830d319e8c2010cdfc98d0f79b345e34826bbf120b5302daae576a3613f7057a3a11e21d7cd30eec370a
SSDEEP

1536:+8JzCW/UdJktK2399cy7fkKUricHVlEFt7L:7JzThDHcy7fkKUricHVlEFt7L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40c06f477aba8fc530697320715ba6da_JaffaCakes118

Files

40c06f477aba8fc530697320715ba6da_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ef81b75bedfd0cdf8f0962badabdec81

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapAlloc
GetProcessHeap
GetProcAddress
LoadLibraryW
FreeLibrary
LoadLibraryA
GetLastError
HeapFree
SetLastError
GetVersionExA
lstrcatA
lstrlenA
GetCurrentThread
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetModuleHandleA
TlsGetValue
TlsSetValue
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
LeaveCriticalSection
EnterCriticalSection
Sleep
VirtualFree
VirtualAlloc
HeapReAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSection

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ