633268ab2bd705162a4c4d75edb16b0c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

633268ab2bd705162a4c4d75edb16b0c_JaffaCakes118
Size

179KB
MD5

633268ab2bd705162a4c4d75edb16b0c
SHA1

6a545eccdf2d9512602f8de3da5c7d3701147857
SHA256

1c853bf967ceca77a45933c402b8a0725cc6c310a2a2731fb7ae672bd2a88ce1
SHA512

bb3cf0d27b845950b4aa9afbb199cac04f3ccc26c55187372dce9d4521db80e4cdb356496e1fdc7a3ab85c463f886c33641bd41040a4689bdb579a2bef648436
SSDEEP

3072:n8UewJCIn4/QGynlZyGYxj0uzszVHfzYQ6WwvLsbh:dewJgsZyZxjjzszBY6aCh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
633268ab2bd705162a4c4d75edb16b0c_JaffaCakes118

Files

633268ab2bd705162a4c4d75edb16b0c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

be58f37041d9fc05bbd6c45cf4d86fca

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
InitializeCriticalSection
IsWow64Process
LocalAlloc
SetUnhandledExceptionFilter

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_fmode
_fpreset
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
memset
signal
strcmp
strlen
wcslen

winspool.drv

AbortPrinter
ClosePrinter
OpenPrinterA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.hkvgd
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE