61d9e988eade69c6acde5a053d291044_JaffaCakes118 | Triage

Sharing

General

Target

61d9e988eade69c6acde5a053d291044_JaffaCakes118
Size

797KB
MD5

61d9e988eade69c6acde5a053d291044
SHA1

ad49a1a376d557c53b75a34b87264deddcdddd8e
SHA256

16a9459a71e9f5b694fb4323e43affc3c6dba050ea7d389684c36d0faf5878cd
SHA512

034338f98bc89b4d159498712c5698a2b8f0fcb9c494cd39c50efced6ffa8a085655a79f44ef78ed8bbc51b97615ff6b6ce2bec833829c9124a102fcf06ecc07
SSDEEP

6144:5ALU8xEuTboDiSPuEmFXqROGW2KCGbEY5BwnK9msAy95Gkd58W4kbbbiccchgmgi:GL5/0DEEmcROGWMGbrwnKH78W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61d9e988eade69c6acde5a053d291044_JaffaCakes118

Files

61d9e988eade69c6acde5a053d291044_JaffaCakes118
.exe windows:1 windows x86 arch:x86

1ef199a4e850b10af8e125fe023aeadb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

kernel32

GetCommandLineA
GetCurrentProcessId
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetTempFileNameA
GetTempPathA
GetVersionExA
LoadLibraryA
LocalAlloc
LocalFree
RtlUnwind

crtdll

__GetMainArgs
_sleep
exit
fclose
fopen
fread
fseek
ftell
fwrite
raise
signal
strcat
strchr

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 308B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 88B - Virtual size: 88B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ

.data
Size: 100B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 904B - Virtual size: 904B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 924B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE