8bbe24212d5677b4d968eedfdd421b8c_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8bbe24212d5677b4d968eedfdd421b8c_JaffaCakes118
Size

25KB
MD5

8bbe24212d5677b4d968eedfdd421b8c
SHA1

87841adcf94ce6ad4d2dd22e9dd8b59b1c1f61b3
SHA256

f43414cda345c397cf16ac749dc6633e48b7d39ac72d0e9585898622555cb4af
SHA512

4dbcab816758b26c289016a806c0e620dcffe2ba0a7f6575d40e3bb6bd99c06404f11fec12b98437b2545f240f5b89c261b695762f60de04d03ff137d1306a9e
SSDEEP

384:PH3N7ddSg8cC1m0aaDpMkFQUoqQFT/GCoCU2Yu3+kQDTbheR7IrS:fN7DC1EcpMkKMmBQDT4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8bbe24212d5677b4d968eedfdd421b8c_JaffaCakes118

Files

8bbe24212d5677b4d968eedfdd421b8c_JaffaCakes118
.exe windows:4 windows x86 arch:x86

609c5c7d2438b224595f01436eb73d63

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AddAtomA
CreateProcessA
ExitProcess
FindAtomA
GetAtomNameA
GetModuleHandleA
GetProcAddress
GetThreadContext
ResumeThread
SetThreadContext
SetUnhandledExceptionFilter
VirtualProtect
VirtualProtectEx
VirtualQuery
WriteProcessMemory

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setmode
abort
atexit
fclose
fopen
fputc
free
fscanf
fseek
malloc
memcpy
signal

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 112B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE