8c482d9dce1b1d7f3a38fe2091420279_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8c482d9dce1b1d7f3a38fe2091420279_JaffaCakes118
Size

8KB
MD5

8c482d9dce1b1d7f3a38fe2091420279
SHA1

fa8a03a5e85f1536c65eb3067ab5e907d7c8ff18
SHA256

a1b9c47b1bdbe468c4032cfa385581bec085ab65f7a272405b9b905b3f61e299
SHA512

ed59688536a4b18d778c45ae48dace9c26ab2900aa927259c9e22500a95534f94be6c090fbca140948dc65717d2deb5656f458a5c646977aae6ba609469dcde1
SSDEEP

192:nqsf7SYVV+xBVzrrrrrrrBN39jnjnjnjnjnjnjeB1NLWqccysMPKnxT:qiip5d9jnjnjnjnjnjnjWttylPKx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c482d9dce1b1d7f3a38fe2091420279_JaffaCakes118

Files

8c482d9dce1b1d7f3a38fe2091420279_JaffaCakes118
.exe windows:4 windows x86 arch:x86

99b83e42dca5d2bd2b97d560051d218c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DebugBreak
DisableThreadLibraryCalls
EndUpdateResourceA
EscapeCommFunction
FlushConsoleInputBuffer
GetCPInfo

msvcrt

?_query_new_mode@@YAHXZ
perror
setlocale
strncpy
strcpy
tmpnam
ungetwc

urlmon

HlinkGoBack
URLOpenPullStreamA
UrlMkBuildVersion
GetClassURL
GetMarkOfTheWeb

user32

ClipCursor
CloseWindowStation
CreateDesktopA
DlgDirListA
DrawCaption
EndPaint

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE