614351157ea3a52cfccf8faed7bdc456_JaffaCakes118 | Triage

Sharing

General

Target

614351157ea3a52cfccf8faed7bdc456_JaffaCakes118
Size

23KB
MD5

614351157ea3a52cfccf8faed7bdc456
SHA1

63590a0ada8fa7c4dbb1b5c3f054ced18ab2f0af
SHA256

235785e43c74815aa13ef19c64eb4eb3f68a5c754adc4e58fdb1e91dad782852
SHA512

eeca5acbd482a4dd674fd25ec06adecec021126b1fa5e507434e59c0e5d520e9a90cadc2ebb8b267e1268b273d0423fcd0961f67521827f522989b1eb8af0be9
SSDEEP

384:+QkbU1vBQA6QEyDJGp31m+njEOWrl2MSaFSzyY825Xrr5BX3QYv5sa:JkbaqA6QEyGB2SaAzp82bVBXAYf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
614351157ea3a52cfccf8faed7bdc456_JaffaCakes118

Files

614351157ea3a52cfccf8faed7bdc456_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1213241b5a33e13babcf0360e6cf0b07

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TlsGetValue
GetVersion
LockResource
SearchPathA
GetCurrentThreadId
HeapCreate
ExitThread
OutputDebugStringA
FormatMessageA
FindResourceA
TlsSetValue
SetProcessWorkingSetSize
SizeofResource
GetStartupInfoA
WriteConsoleA
ResumeThread
GetCurrentDirectoryA
WriteFile
GetCurrentThread
SetThreadAffinityMask
RtlUnwind
GetOEMCP
GetConsoleOutputCP
GetModuleFileNameA
HeapSize
SetEndOfFile
HeapDestroy
VirtualAlloc

msvcrt

_wsplitpath
fseek
wcsrchr
time
_wfopen
_fullpath
qsort
_wcsnicmp
_wcslwr
strspn

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ