7491b46005fab3eb4be120bdce3cf13d_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7491b46005fab3eb4be120bdce3cf13d_JaffaCakes118
Size

276KB
MD5

7491b46005fab3eb4be120bdce3cf13d
SHA1

b90f4d950accfd348616ddfee8208b13033486e6
SHA256

493351bdc0d2e975eea10ee77838778537700ea916c929acb4e2d557f52bdce6
SHA512

45a9b2d1d88da5baeeda812f4421f48352e9c6f2de4e67de5174dd912c0a8edcd7082234b29afde14129a44d9ad8ee2fce6a6c89ce943a4701ab07466ab243ca
SSDEEP

6144:F5xbKTBOK0I7Wf1aGX5D+urFDXVIzLbChSASePvbRkR8H:TxbKTME7Wf1tX5DDlFIDySAxbRk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7491b46005fab3eb4be120bdce3cf13d_JaffaCakes118

Files

7491b46005fab3eb4be120bdce3cf13d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a879895193f395d2f22830f629612ba8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

memset
memcpy
malloc
free
strlen
strchr
strcpy
strcat
strncpy

kernel32

GetModuleHandleA
HeapCreate
HeapDestroy
ExitProcess
HeapFree
HeapAlloc
InitializeCriticalSection
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentProcess
DuplicateHandle
CloseHandle
CreatePipe
GetStdHandle
CreateProcessA
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
WriteFile
CreateFileA
GetFileSize
ReadFile
SetFilePointer
HeapReAlloc

shell32

ShellExecuteExA

Sections

.code
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 244KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE