63e348177b88f08a16331802700a22ee_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

63e348177b88f08a16331802700a22ee_JaffaCakes118
Size

104KB
MD5

63e348177b88f08a16331802700a22ee
SHA1

d9c3ed842df76c771fd327e329f3dedac0a8db4f
SHA256

4e25f48174dc0a0954b6297e13affdd86745fc5bf221f08700cebc4faa6d23e3
SHA512

8863f0395cdfd0f467e1c98c38c765c8895a45cde7e1f52733484b6ff98a8a48939fcb72412a9c75713c719f931d7d5b2021df8c603d36cd990ba53ece664d1e
SSDEEP

1536:foxKygugW2c1WheftRC0CY01kW9Wi5sxoeKm99XVz/udg:wxl0B0tRx0115EDKm9jzq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63e348177b88f08a16331802700a22ee_JaffaCakes118

Files

63e348177b88f08a16331802700a22ee_JaffaCakes118
.exe windows:4 windows x86 arch:x86

bd8911e74ff0ff807f177382b6d9bb11

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetModuleFileNameA
TlsGetValue
LoadLibraryA
FreeConsole
CloseHandle
VirtualAlloc
Sleep
lstrcatA
lstrcpynA
lstrcpyA
GetModuleHandleA
GetProcessHeap
GetCPInfo
GetACP
GetCommandLineA
ExitProcess

user32

GetProcessWindowStation

ole32

CoInitialize

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 586B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE