8478fbe89c699a56c4258969ecdc127c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8478fbe89c699a56c4258969ecdc127c_JaffaCakes118
Size

128KB
MD5

8478fbe89c699a56c4258969ecdc127c
SHA1

03b6703ba24460555f33fec98e6f2c1270dc7fb3
SHA256

1f07fdc0639ae573b751204d56c514613c5fe3d9dd94b7d9bb907994dea3b778
SHA512

7c1ef6b9f24c83b22f584713156632585c6e8c215f57dd17b758456d053d299b63174c2692550e12276c3c8ed7abfc54f04f661e002e740286774154b84266a7
SSDEEP

3072:kprW5t9hbuLmzoTrcmv2b+yjrsI6ToNO4EDPkr:kY9BuSBm5y/aoNO4EDs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8478fbe89c699a56c4258969ecdc127c_JaffaCakes118

Files

8478fbe89c699a56c4258969ecdc127c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8b90ae44ff224f6cf66beaacec433ba7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetProcAddress
LoadLibraryW
ExitProcess
SizeofResource
LockResource
LoadResource
FindResourceW
GetSystemDirectoryA
GetModuleFileNameA
MoveFileA
Sleep
GetFileAttributesW
CloseHandle
ReleaseMutex
GetLastError
LoadLibraryA
GetModuleHandleW
CreateFileA
GetSystemDirectoryW
lstrcatW
lstrlenW
GetTickCount
FreeResource
lstrlenA
WriteFile
CreateFileW
GlobalFree
Process32NextW
lstrcmpiW
Process32FirstW
CreateToolhelp32Snapshot
GlobalAlloc
GetModuleHandleA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary

msvcrt

fopen
fwrite
strchr
strstr
memset
_except_handler3
memcpy
realloc
malloc
strlen
??2@YAPAXI@Z
fclose

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ