42c4c38f589416240e2516f337e848ca_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

42c4c38f589416240e2516f337e848ca_JaffaCakes118
Size

15KB
MD5

42c4c38f589416240e2516f337e848ca
SHA1

d9372025a351ecb3b9c14a035d1d9ce4cf93e08d
SHA256

5b6e132a993e35694fbed01b0a1d3aeb08dc8bc4b7fb1d2d6884ccf8680d867a
SHA512

2c1038f9e1df3a0bb4adbf67c42f0a5b6e06bcefc09ac483e96f7c14401568c2f6dfb760f05e38c27938332a600dafd9b4e9020c35ceb28ed0ee74ddde2f5a32
SSDEEP

192:zY1JXlzcMfR21HZGd+g8zE/YaNvDhqS9d4vnGwR1fjWaTWA:zmJXlz/fRGPg8g/x4X7WaTWA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42c4c38f589416240e2516f337e848ca_JaffaCakes118

Files

42c4c38f589416240e2516f337e848ca_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dceef6da8b9880d36b502099e49510e9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\newqq\IeHostProtector3\Release\IeProtectInst.pdb

Imports

msvcrt

__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__set_app_type
exit
_cexit
_XcptFilter
_exit
_c_exit
fopen
fwrite
_controlfp
_acmdln
_except_handler3
fclose
strlen
sprintf
??2@YAPAXI@Z
memset

kernel32

GetProcAddress
InterlockedExchange
FreeLibrary
LocalAlloc
GetStartupInfoA
GetLastError
DeviceIoControl
GetVersionExA
GetSystemDirectoryA
GetFileAttributesExA
CreateFileA
SetFileTime
CloseHandle
LoadLibraryA
OutputDebugStringA
RaiseException

user32

wsprintfA

shlwapi

SHSetValueA
StrStrIA
SHGetValueA

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE