82e34a7bbc6d4ed112eb8e26ea005cf0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

82e34a7bbc6d4ed112eb8e26ea005cf0_JaffaCakes118
Size

28KB
MD5

82e34a7bbc6d4ed112eb8e26ea005cf0
SHA1

d262a305979fba4adb56540cda3664c37c086117
SHA256

a947b7f2915513fb313ed3ae4ae4085923b46748083c6feca674210c72fdc1b4
SHA512

d76bb103a48670c621d27de49496bcbca1d769132ef4e5e1fa7d3831ec3065d98caa8b610a4643f1e4fa30f16d9c91a5265491a42ae2ace95fbb9bc4b2c17d3e
SSDEEP

384:51kIxCVyapGVoJxH+y0A/2pZPxgwP15n4Dt1bdf:1opGVcxHX0A/2pZFd54DTbdf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82e34a7bbc6d4ed112eb8e26ea005cf0_JaffaCakes118

Files

82e34a7bbc6d4ed112eb8e26ea005cf0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

95d4c80fc5610799f9f9040e9942af16

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateFileA
FreeLibrary
GetProcAddress
LoadLibraryA
Sleep
GetSystemTime
GetWindowsDirectoryA
Process32Next
OpenProcess
GetCurrentProcessId
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
WriteFile
SetFilePointer
DeleteFileA
ExitProcess
GetModuleFileNameA
GetStartupInfoA

msvcrt

sprintf
_except_handler3
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strstr
_strcmpi

wininet

InternetReadFile
InternetCloseHandle

winmm

timeGetTime

psapi

GetModuleFileNameExA

shlwapi

PathFindFileNameA

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ