84f43b0683763aa6b78698efe756b1c0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

84f43b0683763aa6b78698efe756b1c0_JaffaCakes118
Size

148KB
MD5

84f43b0683763aa6b78698efe756b1c0
SHA1

79ad1681aa519ea75c2470a7fbdf5e2061ec114c
SHA256

2cba00a64e0981cd2148161a9365fa3a3a5b4fbaa0962b097067a7f0037179b0
SHA512

86bd04f56cb12a3837de6f9bf39c0d846f3477f4dd44adcc75802e8f56dc539c9f9848335a1ffd1f4315b23878833b9fa39a1cf5ea2612965cbc29ddfaea6262
SSDEEP

3072:fY4p7C+TDRr/rjQT0znZUZDLFg8AHAsypq6LRySGLrFpDxCpk5STA77:QMLDRLrj3zZUZD28mZx6LM7LZZxWA7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84f43b0683763aa6b78698efe756b1c0_JaffaCakes118

Files

84f43b0683763aa6b78698efe756b1c0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd211e2c83c9b4642c33fed8c81b90d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

strncmp
strchr
sprintf
_itoa
_chkstk
atoi
strstr
strncpy
memset
RtlRandom

kernel32

lstrcpynA
VirtualFree
VirtualAlloc
OpenProcess
SetCurrentDirectoryA
GetTimeZoneInformation
GetCurrentProcessId
GetWindowsDirectoryA
GetSystemDirectoryA
ReadFile
Sleep
CloseHandle
WriteFile
SetFilePointer
CreateFileA
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
HeapFree
HeapAlloc
GetProcessHeap
GetSystemTime
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetLastError
GetLocalTime
GetCurrentDirectoryA

psapi

GetModuleFileNameExA

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE