4c8c0be52011f9e70d54877ce34cf1ae_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4c8c0be52011f9e70d54877ce34cf1ae_JaffaCakes118
Size

244KB
MD5

4c8c0be52011f9e70d54877ce34cf1ae
SHA1

a13dcb640a4de275245eaa33523512ac15657254
SHA256

5fc994cc0fee4e88ef1055999db4fc9fae9d86e479e6ff8ffbec927e3816e204
SHA512

36176260490d771e3804d0753a0d19b315a25d8a9b0f9c8c6836304a6c5c649d7a4afb89f3c3580bb2e85b22364c56d7279c5703b68935c07e52cc5cabac3d85
SSDEEP

3072:CYw5V5HJ+P7hhqQUx3zW6QtHHG9h2PRagoVFgJgCde3vSwxPJS4Vq7HduJuWCc5S:H261k3SHtHHrQnFfqOvS7yfM2I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c8c0be52011f9e70d54877ce34cf1ae_JaffaCakes118

Files

4c8c0be52011f9e70d54877ce34cf1ae_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ce9848ada3a75ca89085a7a904f4cb68

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWriteWatch
_lwrite
HeapCreate
GetDateFormatA
DisconnectNamedPipe
WriteConsoleOutputCharacterW
CreateFileMappingW
WinExec
GetProcessHeap
ReadConsoleOutputCharacterW
IsBadReadPtr
SearchPathW
SetConsoleTitleA
GetNumberFormatA
ExpandEnvironmentStringsW

user32

ModifyMenuA
CharLowerBuffW
SendMessageW
DefMDIChildProcA
GetMenuStringW
BeginDeferWindowPos

gdi32

EnumFontsW
AngleArc
GetEnhMetaFileHeader
Escape
GetDeviceCaps
StrokeAndFillPath

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 854B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data0
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE