899533b1d747217eaee14a30e209d800_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

899533b1d747217eaee14a30e209d800_JaffaCakes118
Size

3.4MB
MD5

899533b1d747217eaee14a30e209d800
SHA1

6ef232872e36f31a05c5f3385f18d536518881b2
SHA256

027014a4faefb66e3aa6a8f4399ad01ed7b66da82eaf515c504d619e12f48ce6
SHA512

05ef9f4b6c045adfb662a9256e18f6cfbee492aa3d4a5276016da684ef83f34aac4d09c268221cba9023a6980acf35779035a5da25827b905e071d8dbba33215
SSDEEP

98304:d7UBCM6vl8/4NzIA5dI9gAgMj+yIaYhSEG7naYtbyb1k:BMwP5C9Z7IphzYtIm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
899533b1d747217eaee14a30e209d800_JaffaCakes118

Files

899533b1d747217eaee14a30e209d800_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7ddd00370a67247bbb4b17d82a5439b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
GetLastError
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentDirectoryA
GetEnvironmentVariableA
GetShortPathNameA
GetTickCount
WideCharToMultiByte
GetStartupInfoA
GetModuleHandleA

user32

MessageBoxA

shell32

ShellExecuteA

msvcrt

??3@YAXPAX@Z
exit
atoi
strtok
??2@YAPAXI@Z
_except_handler3
strstr
free
malloc
wcslen
wcsrchr
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_stricmp

ws2_32

gethostbyname

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ