4d717618beb16c434d00c0195967a382_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4d717618beb16c434d00c0195967a382_JaffaCakes118
Size

32KB
MD5

4d717618beb16c434d00c0195967a382
SHA1

0d158b1ed80c4d3a247c7ae238547d9658321de2
SHA256

b01ab5264162abe239b352c9c159808e44d8eb5e26560df7e904f4f16c8efc75
SHA512

9a116095c38150150fdcd7531afc9f5b2a5ec3137fd153c1c66f664fc5a760479213f15858f5091625879a1f74e1f08bd8376779d3ddb81dcada86b3a8045c22
SSDEEP

768:FhdbXc+GW3tY9tdmc75BdfCfUmH2myNaDVukalSS/t9lk03:1eu1ryNSBal99lr3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d717618beb16c434d00c0195967a382_JaffaCakes118

Files

4d717618beb16c434d00c0195967a382_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dbd508167d2168a0eacb179ce402211e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesExA
QueryPerformanceCounter
HeapDestroy
Sleep
HeapFree
HeapCreate
GetTickCount
HeapAlloc
GetProcessHeap
CloseHandle
ReadFile
SetFilePointer
CreateFileA
ExitProcess
GetModuleFileNameA
VirtualAlloc
VirtualProtect
VirtualFree
GetProcAddress
LoadLibraryA
IsBadReadPtr
lstrcmpiA
FreeLibrary
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 710B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE