839ea09192d46b351e01ee4719c5a35b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

839ea09192d46b351e01ee4719c5a35b_JaffaCakes118
Size

176KB
MD5

839ea09192d46b351e01ee4719c5a35b
SHA1

029953a8d092bf382c21740b38468cb8bc1848f1
SHA256

7e6246dc8d8e4083707dcc53f35bf313b03d520efeb3502f10da7e3bfc7e1ec8
SHA512

39b16c9d57f60f6aecdf3480ce5fa9546a64baf5a6ed9d779b57331a321f53ab7114bda3f917916149b30d662377c91bb68ce49296bfc56f769eb29553729fbd
SSDEEP

3072:Iydvz1z1V+wui/L6tJS5bRmYd9m9sWsZw3Z0/lHc8YjnNsBq/1D0T6BLBtaX:j1zf+wui/LrbddFWGw3ZB8Qn+q/86laX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
839ea09192d46b351e01ee4719c5a35b_JaffaCakes118

Files

839ea09192d46b351e01ee4719c5a35b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

0f360066df667954fc3c1ae3a9be798d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExpandEnvironmentStringsA
InterlockedDecrement
LoadLibraryA
OpenProcess
VirtualFree
GetThreadContext
GetCommandLineA
GetProcessHeap
OutputDebugStringA
ResumeThread
VirtualAlloc
GetSystemInfo
ReadFile
SetFilePointer
IsValidCodePage
lstrlenW
TlsSetValue
GetNumberFormatA
CreateProcessA
FatalAppExitA
TerminateThread
FormatMessageA

msvcrt

_splitpath
_beginthreadex
wcscpy
iswctype
_wctime
strncat
strstr
wcscmp
__setusermatherr

Sections

.text
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ