8a4f78405f0c7f1faeb82f6b72ced478_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8a4f78405f0c7f1faeb82f6b72ced478_JaffaCakes118
Size

168KB
MD5

8a4f78405f0c7f1faeb82f6b72ced478
SHA1

c8b8b140e05ea4908d3da768e66d5bd25f22e613
SHA256

64b89201192a93520332b3f092109c84b47096cc1171c0034e0d9db04dfb42cf
SHA512

4be71109af724b798d7e6fdee25887cbbcb59a683232b735c884772454b17865008ebc5dd1ce22fd11083c8d5c0bfaf8b2707ff3b6b16642a2ba151bd7efa170
SSDEEP

3072:RYJXhOoNFF6PQb0qltk0oziL97x0F6n7+13og9I3nPDa6WsfZ7gCJC6:i6ozdAqk0oiFS6urI3ersqCJC6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a4f78405f0c7f1faeb82f6b72ced478_JaffaCakes118

Files

8a4f78405f0c7f1faeb82f6b72ced478_JaffaCakes118
.exe windows:5 windows x86 arch:x86

a754b5e1b5516c9d374464f9361c27ea

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__getmainargs
_except_handler3
_controlfp
_acmdln
exit
_XcptFilter
_exit
memmove
memcpy
??2@YAPAXI@Z
__set_app_type
??3@YAXPAX@Z

user32

LoadMenuA

kernel32

VirtualFree
LoadLibraryA
GetProcAddress
GetModuleHandleA
VirtualAlloc
CreateThread
GetStartupInfoA
WaitForSingleObject

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ