4489d71be7ab584af7832c28f1674171_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4489d71be7ab584af7832c28f1674171_JaffaCakes118
Size

29KB
MD5

4489d71be7ab584af7832c28f1674171
SHA1

391166d975e287368bff2f096ecc8e4bf27ed84b
SHA256

41a528c511c902a9085a0518efeea084beb086f99240ce2004adc62781dd69b4
SHA512

cf8e0fba56930daef53273c0da9d1f9a7dc7e7f62e0a2a55bdd6e2e11fe74c6fa9ef7a1d71eff8de05a8e8b5dccc84897b775a173cc3769fbefc1a6c16df93c0
SSDEEP

768:87yjlFtG0RV3XDbCSMhntkbhLUCzg8Oml/IeWH:dZnR5XDurhn2WmNu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4489d71be7ab584af7832c28f1674171_JaffaCakes118

Files

4489d71be7ab584af7832c28f1674171_JaffaCakes118
.exe windows:4 windows x86 arch:x86

996391224e64898aee8dd641764696cb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

RtlUnwind
GetSystemInfo
GetCurrentProcess
PulseEvent
FatalAppExitA
SetLastError
GetCurrentDirectoryA
FileTimeToSystemTime
InterlockedExchange
FindClose
GetCurrentProcessId
DeleteFileA
SetEndOfFile
GetModuleHandleA
TerminateProcess
LCMapStringA
HeapAlloc
ReadProcessMemory
LocalFree
InterlockedDecrement
HeapSize
ReadFile
GetCommandLineA
GetTimeFormatA
SetPriorityClass
GetStringTypeA
VirtualAlloc
GetLastError
GetVersion
GetCurrentThread
GetProcAddress
LeaveCriticalSection

msvcrt

wcschr
memcpy
_fullpath
sprintf

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ