610600d0969f248ae90bf5eac1b21907_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

610600d0969f248ae90bf5eac1b21907_JaffaCakes118
Size

73KB
MD5

610600d0969f248ae90bf5eac1b21907
SHA1

4fc9132d2ffe8508fe88da60070e4442428d112d
SHA256

1b9dec099da9063ba6756b6971471aae576b40b14f404cdb2157076ad994bd90
SHA512

d1a6ee799b08add8ede159d6bc0a957baa96ccdee0e2ccff2d917f60ad7652de93f7d3dfd1f2025047bf65dc74d7081923306be4d945958894e2e436b28022b1
SSDEEP

768:UoYC6q11h+3Zy280N/xWoynyb6lpYIRfRxrQJEVXqZXG0SgSVNo0pZTr:NLL90Zp+y9IfbQJ5ZmgSVNB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
610600d0969f248ae90bf5eac1b21907_JaffaCakes118

Files

610600d0969f248ae90bf5eac1b21907_JaffaCakes118
.exe windows:1 windows x86 arch:x86

e21dc0198447fb7a658a785f3c907181

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

wcscpy
iswascii
_acmdln
_waccess
_ultow
ctime
__getmainargs
_controlfp
memcpy
_flushall
exit
__p__commode
clearerr
fscanf
_XcptFilter
__setusermatherr
_except_handler3
__p__fmode
__set_app_type
fseek
_cprintf
_initterm
_fsopen
_strtoi64
freopen
_adjust_fdiv
_mbsnccnt
_exit

kernel32

SetLastError
HeapCreate
GetCommandLineA
ExitThread
DuplicateHandle
HeapAlloc
GetStartupInfoA
HeapSize
GetModuleHandleA
MulDiv
GetCurrentProcessId

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ