842f8a7b2a2f55b4ad32efbf6525cb62_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

842f8a7b2a2f55b4ad32efbf6525cb62_JaffaCakes118
Size

64KB
MD5

842f8a7b2a2f55b4ad32efbf6525cb62
SHA1

4927a0977bd35469e9f81c5aa503bf47f54853d1
SHA256

35aa568acca6bd6ba39bec269b58ac2246d14b45d3b4c9998b5b0ec5ce5a20dd
SHA512

6880325163adb4204213c44162c24837b510df57a9d9d4af3cb7b02014646921cbb6cdf3cc644e60c3fd30bf8b894e43b8bd616420284fae6f87ba4709e7979b
SSDEEP

384:eKx0opJm432Y8cA5r96jVvrJxzOdCgwBZoWiD5tN+AszbQ0VMDfqNUvbOry:lx0opJhGlrKdrJxzVoWqMrk0KDZTOry

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
842f8a7b2a2f55b4ad32efbf6525cb62_JaffaCakes118

Files

842f8a7b2a2f55b4ad32efbf6525cb62_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a637103a203e48fc85ef20d032737c9f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

TerminateProcess
WriteProcessMemory
VirtualAllocEx
GetThreadContext
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleFileNameA

mfc42

ord537
ord800
ord5572
ord2915
ord939
ord4278
ord860
ord823
ord540
ord922

msvcrt

exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_onexit
__CxxFrameHandler
__dllonexit

msvcp60

??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ

shlwapi

StrToIntExA

Sections

.text
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE