69c3e1103e249291612965a3b1245188_JaffaCakes118 | Triage

Sharing

General

Target

69c3e1103e249291612965a3b1245188_JaffaCakes118
Size

283KB
MD5

69c3e1103e249291612965a3b1245188
SHA1

5afcbfc677901a044e0d4f6767b64d8b57888f2a
SHA256

9d48eb5ad626686052cd7676c558fbc898c576ce172dabac31d2ead0f3732b23
SHA512

f73f7598a88a6dab731fd3be54fbe779729de85d46b4cad0e6e5e21c77191d84fc9f86295d2e697bbe717bb5ee363becbb7a134b9cdeb3f35cf648d07afa6b4f
SSDEEP

6144:8limHI1dSa/ClvsQqcM9AkrUZFogZfvdvPp:8limo1dSdlv7/PZFog

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69c3e1103e249291612965a3b1245188_JaffaCakes118

Files

69c3e1103e249291612965a3b1245188_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9ee426285c0583a6046162c0acf9fa4f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
CreateThread
GetProcAddress
LoadLibraryA
GetTimeFormatA
GetModuleHandleA
GetStartupInfoA

user32

DispatchMessageA
PostQuitMessage
DefWindowProcA
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
ShowWindow
GetMessageA
MessageBoxA
TranslateMessage

msvcrt

_exit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
strlen
??2@YAPAXI@Z
memcpy
sprintf
__setusermatherr
memset
memmove
atoi
getenv
_XcptFilter
exit
_acmdln
__getmainargs
_initterm

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ