7571e1584635cd57bffcc4f26b120934_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7571e1584635cd57bffcc4f26b120934_JaffaCakes118
Size

1.5MB
MD5

7571e1584635cd57bffcc4f26b120934
SHA1

504d16e5d2fcc2f5fec462ab247ce28b0c9f1eda
SHA256

7c5867d6fd73ca197dc70a74efd39de26bc79cc9bcebdc62b04e7b9e93a97ff3
SHA512

ca23d07d806f457f392931d79d7f6d0f2509dcefeea8f82798e29a25aaf743bc88db06755d301c7e0a46f2202dc7f913cee7e5accb3c46e7585add0bb53babaf
SSDEEP

24576:5NJxW+6SG9+S9sSDHIMonUumlOOrsFX88uxY8nwytTKP+rhwOYUcDBqzBqekVUN3:5NjYnbSNmlbrus8uhwKa+rSOqDBqzBdn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7571e1584635cd57bffcc4f26b120934_JaffaCakes118

Files

7571e1584635cd57bffcc4f26b120934_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d6e344391693b1651eb8a01b91202e13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\EITreleases\EIT-1.8\Distrib\free\build\ex_inst_toolkit\xinst_lzma\Release\xinst_lzma.pdb

Imports

comctl32

ord17

user32

MessageBoxA
wsprintfA

kernel32

FreeLibrary
LoadLibraryA
GetTempFileNameA
HeapAlloc
ExitProcess
GetModuleFileNameA
HeapFree
ReadFile
lstrcatA
CloseHandle
CreateFileA
GetTempPathA
GetProcessHeap
DeleteFileA
CreateDirectoryA
GetWindowsDirectoryA
GetStdHandle
lstrcmpA
GetLastError
GetProcAddress
WriteFile
GetCommandLineA
SetFilePointer
lstrlenA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ