4b3290a896cac0d344b23a23250802d5_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4b3290a896cac0d344b23a23250802d5_JaffaCakes118
Size

1.2MB
MD5

4b3290a896cac0d344b23a23250802d5
SHA1

343ba2ba21bf0a88deb510f36f43243f72780a74
SHA256

f11a4d39ee5339cd98ba64f77966004bc748522f03fec1112e0b5f6350d3e5d9
SHA512

7d40f7b1d9f7b360368e45a4a6c98664961e06d462bc0d7a56baa2a9e0223db19578d8413fb7e575657473dce9853c09372f766d981acd9a0113814bf9544bc9
SSDEEP

24576:zSE55CyCv75jA1LThmt8G/v+6MYB++mOjvYcn4f3W+FQlh1yofUwJxZc:zSt3v7501LTcbWmgOjvY3lQLpJxe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b3290a896cac0d344b23a23250802d5_JaffaCakes118

Files

4b3290a896cac0d344b23a23250802d5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

95ce2e5d2aa18289fb27b427878d6934

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
CreateFileA
FindResourceA
lstrcmpA
lstrlenA
FreeLibrary
LoadResource
FormatMessageA
WriteFile
GlobalAlloc
SizeofResource
lstrcatA
FindFirstFileA
GetLastError
lstrcmpiA
GlobalFree
FindClose
LockResource
GetModuleFileNameA
FindNextFileA
LoadLibraryExA
CloseHandle
LocalFree
lstrcpyA

user32

LoadStringA
MessageBoxA

comdlg32

GetSaveFileNameA

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ