87cf5b0a5d5639734af4de50bf6aa4ac_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

87cf5b0a5d5639734af4de50bf6aa4ac_JaffaCakes118
Size

20KB
MD5

87cf5b0a5d5639734af4de50bf6aa4ac
SHA1

4f9e481caeaeaa90a049fec0f7c0dc15672fb36d
SHA256

5b4bd7266f4107d96077ee69b8cefe3e3e5508e08ad5064086dd3ea388018b11
SHA512

fbb981f11e2323a26d80113bba5059ea4cd6168376a0cf85fabf2dfb11f7ae38155070eca62f4f0016570221ca1544821529e52e27c0a6792037f79c1179421f
SSDEEP

192:mfHWSbrRkaVdfoPw4Y9Yn4WYw/kx6OFKL7QCDe:Ab1fMw4Yq45wGVoL73C

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
87cf5b0a5d5639734af4de50bf6aa4ac_JaffaCakes118

Files

87cf5b0a5d5639734af4de50bf6aa4ac_JaffaCakes118
.exe windows:4 windows x86 arch:x86

31f5fa639186f0e87ebba96b6e48d4b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
CloseHandle
CreateToolhelp32Snapshot
ExitProcess
FindAtomA
GetAtomNameA
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
OpenProcess
Process32First
Process32Next
SetUnhandledExceptionFilter
TerminateProcess
lstrcmpA
lstrcpyA
lstrlenA

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_iob
_onexit
_setmode
abort
atexit
fflush
fprintf
free
malloc
memcpy
signal
toupper

user32

MessageBoxA

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 176B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE