850eb43679a9f66192130bf8c64a54e2_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

850eb43679a9f66192130bf8c64a54e2_JaffaCakes118
Size

294KB
MD5

850eb43679a9f66192130bf8c64a54e2
SHA1

d5e77db16500d6ff5045df0558dbaccc52db716d
SHA256

c0577ac450653ff255390f3c22cfb16311978850d4bbb98677adbacfe2c3f37e
SHA512

dbcef13bc71acf88cbf6dc3deea744d2804ab1c68a53ccb491f620829bce5a5536e4a0e8f5677a7a7f84197cf11845562c64d35acf73cd519f1a158924d5f2a5
SSDEEP

6144:Hrvkn5hbLu4Ut2FHigrVBAYNDj6J2LH35vh9QS3M:I5VauZgYm2jlh9QsM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
850eb43679a9f66192130bf8c64a54e2_JaffaCakes118

Files

850eb43679a9f66192130bf8c64a54e2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

ee321ea762034f53675dedaa74b424b0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetModuleFileNameA
GetTickCount
LockResource
GetModuleHandleA
SizeofResource
FindResourceA
CreateMutexA
OpenMutexA
LoadResource
GetProcAddress
GetStartupInfoA

advapi32

GetUserNameA

msvcrt

strstr
_except_handler3
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
exit

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 830B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE