71acb5193697a08faf25bc21615a2fd8_JaffaCakes118 | Triage

Sharing

General

Target

71acb5193697a08faf25bc21615a2fd8_JaffaCakes118
Size

20KB
MD5

71acb5193697a08faf25bc21615a2fd8
SHA1

76890f372f6821a5b6f3d1dfe66628fff9c7a252
SHA256

44994caaf5d402805b282b11cc16d9b117df229870ad73fa4e39b39dec062bb0
SHA512

4f0898f86dc3b7a47dc345d2ec1679b2f5c7ce3130462f02f209aa85d8d3f56f9b08888fd4c6b80742250a0e76b3cb5298ee6af37ca9f976106a41037bb510bb
SSDEEP

384:SKr7sKQFYXXx1RO/e2Yvb/jGMV6zMiNJBDIfFpBu6jyEyotx2wyPVE07zeV7tnq:3r7VUYXfNbdVE7oBfjyEyYAwya07zG7k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71acb5193697a08faf25bc21615a2fd8_JaffaCakes118

Files

71acb5193697a08faf25bc21615a2fd8_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4802a41c6a13580c91227e6a449c7e8a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OutputDebugStringA
MoveFileA
WriteFile
CreateFileA
GetTickCount
GetTempPathA
LockResource
LoadResource
SizeofResource
FindResourceA
WinExec
Sleep
ExpandEnvironmentStringsA
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
DeleteFileA
FreeLibrary
GetModuleFileNameA
CloseHandle
GetModuleHandleA
GetStartupInfoA

msvcrt

sprintf
remove
strcpy
fclose
fwrite
fopen
strcmp
_iob
memcpy
??2@YAPAXI@Z
printf
??3@YAXPAX@Z
rand
srand
malloc
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strlen
strcat

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ