63834e0757f137823065cf3baf13ba54_JaffaCakes118 | Triage

Sharing

General

Target

63834e0757f137823065cf3baf13ba54_JaffaCakes118
Size

301KB
MD5

63834e0757f137823065cf3baf13ba54
SHA1

55992659615c1e942dac0d6e52cc28a996dc7e3c
SHA256

cc80407374c3b3d5713e7d5ffe8a1fa62eaa3f188cd812d95a1fc1519d28b16d
SHA512

6b7ee41440f5059c92bc4cf8d35c37dc8eb6c6633c7cc5f1c69356fd43b6b94c13e56de6df14c76bad7eda4ce7f6082a7db7e84f792245c5b500182b987eef89
SSDEEP

6144:eR9ccagrXQMjADSAJq3cUM6KIib/qyeQY8zhu1vPaA63WRUMaM:eR9ccagrAMUDSEU75ijqynY8zhu5athS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63834e0757f137823065cf3baf13ba54_JaffaCakes118

Files

63834e0757f137823065cf3baf13ba54_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d98bf941be5785babc6dd6006dbcc5e6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetModuleHandleA
WriteFile
GetTempPathA
GetProcessHeap
GetCommandLineA
DeleteFileA
WaitForSingleObject
CreateProcessA
CloseHandle
ExitProcess
GetModuleFileNameA
RtlUnwind
HeapReAlloc
SetFilePointer
ReadFile
HeapAlloc
CreateFileA

user32

MessageBoxA

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 566B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE