41b343848bb3618be4dad95c590db182_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

41b343848bb3618be4dad95c590db182_JaffaCakes118
Size

1.1MB
MD5

41b343848bb3618be4dad95c590db182
SHA1

44979a0a4eb9c3c057965f099497d14677389e67
SHA256

e815ec32a3f9dece58c83ee7836491cba8a3914e4a59e9884a819d6d8e66d74c
SHA512

da0498adf7b7ddba81f6325be349cfc8738ee1bbfbd0abba2bed7d73672d7b7b5ba0a4c5f42e134a3bdc3bd0dbc02a062d49839069ce1c651f509edbf38a66d3
SSDEEP

6144:J5yvApFc2+I3cLXl103tc6m9677po59UD5I1sS:JgYj+JX657NumI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41b343848bb3618be4dad95c590db182_JaffaCakes118

Files

41b343848bb3618be4dad95c590db182_JaffaCakes118
.exe windows:4 windows x86 arch:x86

04ee9df49c79436f61806f499ab87ce5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcessId
GetCurrentProcess
GetModuleHandleA
GetCurrentThread
GetTickCount
GetModuleHandleW
GetLastError
GetUserDefaultLangID
GetCurrentThreadId
GetUserDefaultLCID
GetSystemDefaultLangID
VirtualAlloc
CompareStringA
GetProcAddress
MultiByteToWideChar
MulDiv
VirtualFree
LockResource
GlobalFree
SetFilePointer
GetEnvironmentStrings
TerminateProcess
DeleteCriticalSection

msvcrt

_exit
exit
free
_cexit
_controlfp

Sections

.text
Size: 333KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 784KB - Virtual size: 783KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ