840d8b0399765b12352cd13f23bfb492_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

840d8b0399765b12352cd13f23bfb492_JaffaCakes118
Size

88KB
MD5

840d8b0399765b12352cd13f23bfb492
SHA1

cb3e2d9e58617f2bd075a4753af3527744b8d44d
SHA256

6a63fe52c4969494ac0c5541fbbed88117b5f486da5e5d42166bc0a7da0947f1
SHA512

34b8e049f2ab70cfe8e4cc1a53a0e9a35789f3f5497d64f527f46d55dc81e7306b6d99fbdbf323cdb886f65b1e4e2c790e199db324bcc435232d9cd2727e7092
SSDEEP

1536:/5xCyiqtbfwQCSgvB9e3LZRcynMjaE0N63kWLaK5OesRS3mC:/tiyCSQm7ZXMjaEfkWL9O/C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
840d8b0399765b12352cd13f23bfb492_JaffaCakes118

Files

840d8b0399765b12352cd13f23bfb492_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a1fccd353be230e612ec48fdc6d47e2c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wsock32

send

msvcrt

_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
strtok
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
atoi
_controlfp
sprintf
malloc
rand
free
fopen
fclose
__setusermatherr

kernel32

GetModuleFileNameW
GetProcAddress
Sleep
OutputDebugStringA
GetModuleHandleA
GetStartupInfoA
GetCommandLineW

user32

MessageBoxA

shell32

SHGetFileInfoA

ole32

CoCreateInstance
CoInitialize

Sections

.text
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ