629db3e0d9f9a92548b8f7cc085ff2c9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

629db3e0d9f9a92548b8f7cc085ff2c9_JaffaCakes118
Size

114KB
MD5

629db3e0d9f9a92548b8f7cc085ff2c9
SHA1

c5b577cfaf6375c5d874101daaa39c83f2bb48b4
SHA256

7931618c87bb4c7154a13cbae7cdf51a15dd1e8d9b3d578b1803ee10f5de1d0e
SHA512

58ae8cb7ccfe3db39fe7c71c5f00a1af0bd043a78992118240952bb24b229d9080109fc0bff043e26cb1d202b6a15ebcd12ea3002bf3b2f4830e259c40ec8dc6
SSDEEP

3072:uC4QxY9UO+cqGqLczp/M/QTBhNbkDBFt6liyAyb:b4VecqGqIzp/MoTBhNQvtF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
629db3e0d9f9a92548b8f7cc085ff2c9_JaffaCakes118

Files

629db3e0d9f9a92548b8f7cc085ff2c9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

eeeb2c15ae338465c07d92b3d3bc582c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
lstrlenA
GetCurrentThread
GetTempPathA
lstrcpyA
GetTickCount
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateRemoteThread
ExitProcess
WinExec
GetCommandLineA

user32

CharLowerBuffA
wsprintfA

shell32

ShellExecuteExA

ole32

CoInitialize

msvcrt

memcpy
??2@YAPAXI@Z
strrchr
strcpy
strncat
strstr
free
_except_handler3
_exit
_XcptFilter
_controlfp
exit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__CxxFrameHandler
_acmdln
memset
strlen

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 107KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE