8a6e3b0744feecb6cb8f7a5500f8c82b_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a6e3b0744feecb6cb8f7a5500f8c82b_JaffaCakes118
Size

97KB
MD5

8a6e3b0744feecb6cb8f7a5500f8c82b
SHA1

b9dc3d6d2cdbd6221461c50ab827e70c78328a79
SHA256

d8aba8b3c0c5a9f6293dca89b57f572f4bb271683a8d15e4f6a1f80631b69109
SHA512

4461341e36e41221392c12cebb4583491997421671a9ffde9624bda6e9efb67561a93e65c60403c60b5b7c1b4ce681fc62c41b7dbce785813dffc88ca8d291b6
SSDEEP

1536:CkrOUt4UI4DbODRfx1mtfsvXNgcmBMRXeVNbUIagIrD1B17o6964wTwb2Q:CuODRp4tqXZmoOVJBrQ/Fy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a6e3b0744feecb6cb8f7a5500f8c82b_JaffaCakes118

Files

8a6e3b0744feecb6cb8f7a5500f8c82b_JaffaCakes118
.exe windows:5 windows x86 arch:x86

ce6be224d531fe6a32453743f71f17cd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetACP
GetStartupInfoA
EnumResourceNamesA
VirtualAlloc
EnumResourceTypesA
LockResource
FindResourceA
GetModuleHandleA

oleaut32

SafeArrayAccessData
VariantClear
SysAllocString
RegisterActiveObject
SysAllocStringLen
RevokeActiveObject
VariantInit
CreateStdDispatch
SysReAllocString

msvcrt

_cgetws
_chgsign
_access
_chdir
_cabs
_beep
_assert
_c_exit
_atoldbl
_atoi64
_cgets

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ