475cb43f612d37b64c487553592ec7d3_JaffaCakes118 | Triage

Sharing

General

Target

475cb43f612d37b64c487553592ec7d3_JaffaCakes118
Size

39KB
MD5

475cb43f612d37b64c487553592ec7d3
SHA1

a116a1b5a98d1bbcdccff100f028855e57eedc6a
SHA256

f1a640b3b81b10898b78831cc8af60804f5df56231414437f62c81ca814304c1
SHA512

8aa510321550fe07e566ce34a0e4de322c97486231f30d7c926c6480739c39a95b556f87708d824876612b6e371cc8c267983ce392732019f652b78ae1c72420
SSDEEP

768:ClFOug8pCW9PGDQmU4yiGhJkqyVzLK/zRjT6GLG5:ClEnoCu+xDSIVXutTfL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
475cb43f612d37b64c487553592ec7d3_JaffaCakes118

Files

475cb43f612d37b64c487553592ec7d3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c190bc29f7d5a9ed359d30265e84cc48

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey

msvcrt

_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
srand
strstr
fopen
fread
fwrite
fclose
time
strchr
_controlfp

kernel32

GetStartupInfoA
Sleep
DeleteFileA
LoadLibraryA
CreateMutexA
GetLastError
FindResourceA
LoadResource
LockResource
SizeofResource
CloseHandle
GetTickCount
lstrcpyA
lstrcatA
lstrlenA
GetModuleHandleA
GetProcAddress
GetVersionExA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ