6610b93966b21c8a29df5782c14732c9_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6610b93966b21c8a29df5782c14732c9_JaffaCakes118
Size

233KB
MD5

6610b93966b21c8a29df5782c14732c9
SHA1

26bc6a36ea6de1a57718436a95cf893564968e98
SHA256

6fcfadd5d070800221f225235856c60698368899c542863a581fbafc42dd89c9
SHA512

d7383f98fb516d4ee1e874ed0d4b04f06bb2934b8fe87a2964c66ce67ff6e6776b04ba0cce128b138522f5fcc97f83a265b6fce16270ad85b5f448d50d32358a
SSDEEP

6144:jQhceMcCBGkMHTJNqZqGwU72D1xJt0d5E:jQUBOH1N2qGwk2dyE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6610b93966b21c8a29df5782c14732c9_JaffaCakes118

Files

6610b93966b21c8a29df5782c14732c9_JaffaCakes118
.exe windows:4 windows x86 arch:x86

6039c26165040db47e28057ca34786ef

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

srand
memcmp
strcat
isdigit
isspace
memcpy
rename
memset
_EH_prolog
__CxxFrameHandler
strcmp
strncpy
strstr
strcpy
rand
abs
strlen

user32

MessageBoxA
wvsprintfA

kernel32

GetModuleHandleA
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
GetTickCount
GetStartupInfoA
GetCommandLineA
ExitProcess

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

. rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE