4a63ac63599e52ccb18a35368dbccba3_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4a63ac63599e52ccb18a35368dbccba3_JaffaCakes118
Size

92KB
MD5

4a63ac63599e52ccb18a35368dbccba3
SHA1

4c97577b524910b28e406a0a49abbe0b917e3055
SHA256

c0e162790f07e0169a455299574d9c9597db1091a23a0aba4cf508692548147c
SHA512

7d4b76578f937701f671aa40536a182426e49fb04872d940c87ebc9f3e1ed7838f42b30ec18ead29ea4ae6cc3c738251a594d8789f0871966497a2ae1d036c33
SSDEEP

1536:qyFd7tGH1vt/jCp4Q23i8ZR7j9k3WIBLCzTpLldkd1:qyFd7a1u6hWzLCzTO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a63ac63599e52ccb18a35368dbccba3_JaffaCakes118

Files

4a63ac63599e52ccb18a35368dbccba3_JaffaCakes118
.exe windows:4 windows x86 arch:x86

969210bf3868d45da0d15428087ca688

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
GetProcessVersion
GetFileType
GetFileTime
GetLogicalDrives
CallNamedPipeA
ReadFileScatter
UnmapViewOfFile
OpenSemaphoreA
lstrlenA
SetTermsrvAppInstallMode
DuplicateConsoleHandle
GetUserDefaultLCID
RegisterWowBaseHandlers
GetCommandLineA
GetStartupInfoA
ExitProcess
GetProcessHeaps
LocalUnlock
FindCloseChangeNotification
GlobalFree
FlushViewOfFile
SetTermsrvAppInstallMode
IsBadWritePtr
lstrcatA
SetThreadPriorityBoost
GetConsoleInputExeNameA
GetTimeFormatA
WriteFile
GetPrivateProfileSectionA
SetFilePointerEx
Module32First
WritePrivateProfileStructA
lstrcmpA
Sleep

Sections

WEIJUNLI
Size: 4KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ