619d0b5c75ef902266cce2f385657ec1_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

619d0b5c75ef902266cce2f385657ec1_JaffaCakes118
Size

66KB
MD5

619d0b5c75ef902266cce2f385657ec1
SHA1

63c4cda79ecc7942f7f13df43ddc99beaba86755
SHA256

5d9533df8d3ae3d6c99dac8d7e823e65fda76263934bf5d681799dfeb6c853ba
SHA512

c63fe9173cc7b23f5142acb8f4f83c31f35beac32d9ef0392b2e431631dd565779bc48d8b6bea9eee805cdce23a78ba6d089c314d66f5d9dc0663c6f14393b3f
SSDEEP

768:Mn3SBAdJ22b2xpj3wnyaX6+RjUuQdTc9cH4x/s6hR9LoITkuvknGV700vEsyx6Dz:uSBAbp28LM4Rd1xgy702Kx6+m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
619d0b5c75ef902266cce2f385657ec1_JaffaCakes118

Files

619d0b5c75ef902266cce2f385657ec1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd211e2c83c9b4642c33fed8c81b90d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strncmp
strchr
sprintf
_itoa
_chkstk
atoi
strstr
strncpy
memset
RtlRandom

kernel32

lstrcpynA
VirtualFree
VirtualAlloc
OpenProcess
SetCurrentDirectoryA
GetTimeZoneInformation
GetCurrentProcessId
GetWindowsDirectoryA
GetSystemDirectoryA
ReadFile
Sleep
CloseHandle
WriteFile
SetFilePointer
CreateFileA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetProcessHeap
GetSystemTime
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetLastError
GetLocalTime
GetCurrentDirectoryA

psapi

GetModuleFileNameExA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE