5cbb764b6c46a00f8b2719f3ced6c71a_JaffaCakes118 | Triage

Sharing

General

Target

5cbb764b6c46a00f8b2719f3ced6c71a_JaffaCakes118
Size

24KB
MD5

5cbb764b6c46a00f8b2719f3ced6c71a
SHA1

273219a12d34189cb046ed252222ea662451100c
SHA256

e1bf617331bc10f270d9d646dce5b8bd12793af399c4c313c38fbb85a2e2c273
SHA512

559e579fc4875c5db3952efcd08b0cd2689a007c957c801e693901e805715b527fcf605a7d07dfd7f09c8ffb11d1b8312e2888f7c55fa82520cb1991b66e6d73
SSDEEP

192:aeWOTYfcMRpsOanxRBXu4Q5MStkHjcXOaK:a3Osf/pRcj+P5PucXOa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cbb764b6c46a00f8b2719f3ced6c71a_JaffaCakes118

Files

5cbb764b6c46a00f8b2719f3ced6c71a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8abc58eadb182c963ff7a59d6b281e68

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

strrchr
_ftol

kernel32

GetModuleHandleA
ExitProcess
HeapAlloc
HeapReAlloc
HeapFree
IsBadReadPtr
GetProcessHeap
CopyFileA
CloseHandle
WaitForSingleObject
CreateProcessA
GetStartupInfoA
GetCommandLineA
GetWindowsDirectoryA
GetSystemDirectoryA
GetModuleFileNameA
GetTempPathA

user32

DispatchMessageA
wsprintfA
MessageBoxA
FindWindowA
TranslateMessage
GetMessageA
PeekMessageA

urlmon

URLDownloadToFileA

shlwapi

PathFileExistsA

shell32

SHGetSpecialFolderPathA

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE