4b5c15011162caa9163748758048c8c9_JaffaCakes118 | Triage

Sharing

General

Target

4b5c15011162caa9163748758048c8c9_JaffaCakes118
Size

112KB
MD5

4b5c15011162caa9163748758048c8c9
SHA1

283c30de200afb9c607203f9677771e351b8d625
SHA256

10d2a8c67ed0682d61a1178b3c9f6d021eee72e6444b31749e43feabe990851c
SHA512

360f14ecaf1abf528757db896927331be38f9bcdc49cb181d2438f67cb802f63d8630950b2f2791e0ce2a8748b56912ddac015cae614280ac3034907ae342dbc
SSDEEP

1536:95LO7C3P3CO9Lgl9hqC6z7nO14WPjFrJf:95eAP3COafwm1R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b5c15011162caa9163748758048c8c9_JaffaCakes118

Files

4b5c15011162caa9163748758048c8c9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

5d12d49648bec59edb4d3380a3d99d3c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateToolhelp32Snapshot
Process32First
Process32Next
CloseHandle
OpenProcess
GetModuleHandleA
GetProcAddress
CreateRemoteThread
GetProcessHeap
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
WriteFile
CreateFileA
WaitForSingleObject
CreateProcessA
GetStartupInfoA

msvcrt

sprintf
strncpy
strncmp
atoi
_ftol
_CIfmod
_CIpow
modf
_strnicmp

user32

wsprintfA
MessageBoxA

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 858B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE