41138569efabd13063bd49e2877f84af_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41138569efabd13063bd49e2877f84af_JaffaCakes118
Size

156KB
MD5

41138569efabd13063bd49e2877f84af
SHA1

4b5412aab1db498d2e21c1d9ed27f8ec288a9aef
SHA256

7b7be5aac817b290e180c29f382ccf7e29e50f51020d47ef16ca7d6ac8f68c57
SHA512

f42385184481d668f6633331a224aacb274232f1d305fb747d108cd4e94f1251c9281ae52ca0db38a90ba76d2e70a773b527925b4a13acd87a5655da716aaf1b
SSDEEP

3072:5DCvO4m30uNcLvY0HttcPILUUldcYmPIoihzsB:5DcOXZcrHMPvUljPoi9M

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41138569efabd13063bd49e2877f84af_JaffaCakes118

Files

41138569efabd13063bd49e2877f84af_JaffaCakes118
.exe windows:1 windows x86 arch:x86

7274e169aba889ea1f3d618f88f70b93

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wtof
_acmdln
_wstati64
_setsystime
__setusermatherr
_adjust_fdiv
_initterm
_controlfp
_mbsnbicoll
_wtol
_exit
__set_app_type
getchar
memcpy
_execve
__p__commode
ftell
_except_handler3
__p__fmode
printf
_XcptFilter
_fdopen
exit
__getmainargs
_ismbcpunct
mbtowc
_tzname
_splitpath

kernel32

GetModuleHandleA
OpenEventA
GetACP
DuplicateHandle
FreeLibrary
WaitForMultipleObjects
GetCPInfo
MulDiv
SizeofResource
SetEvent
HeapCreate
GetStartupInfoA
HeapAlloc
LeaveCriticalSection

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 85B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 396B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ