448f2739eee8275d1e88b6bb27698c27_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

448f2739eee8275d1e88b6bb27698c27_JaffaCakes118
Size

403KB
MD5

448f2739eee8275d1e88b6bb27698c27
SHA1

3012c7abaef2ec3730d86cf5d8cc1152b5e76e90
SHA256

4f7f37fa5e3fde9a29eb19281f7a6335267fa942f5114d71600a448108e0c77d
SHA512

f6ca4874fce6d68bd5ac7a3b4f32f55e6ed384c3ae5993aa42c44cce70a380d8590e22d1b6ecd37db82ce981653a064aac2fbe8145a8a39964ae15a27d6d928f
SSDEEP

12288:/r9XhfZjZAw5+HOdlGsmZd5xDnjT4Ee2zc0TX19CLaK0UXYBv0qgvT9uhWoniqlI:/rVhfZjZAu+elgXVnjkEe2zc0Tl9NK0a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
448f2739eee8275d1e88b6bb27698c27_JaffaCakes118

Files

448f2739eee8275d1e88b6bb27698c27_JaffaCakes118
.exe windows:4 windows x86 arch:x86

14b38c0011e50c35cb692afd91162143

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
TerminateProcess
LockResource
GetModuleFileNameA
GetProcAddress
VirtualAlloc
HeapReAlloc
LocalFree
lstrcpyn
GetSystemTimeAsFileTime
GetCurrentProcessId
HeapAlloc
GetTickCount
GetCurrentThreadId
GetCurrentProcess
GetModuleHandleA
GetEnvironmentVariableA
WriteConsoleOutputCharacterA
GetAtomNameA
InterlockedExchange
RtlUnwind
GetProfileStringW
QueryPerformanceCounter
VirtualQuery
LoadLibraryA
ExitProcess
GetShortPathNameW
CreateWaitableTimerW

comdlg32

GetSaveFileNameA

Sections

.text
Size: 123KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 265KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ