8cf26505203d553b12a389b745cc56b1_JaffaCakes118 | Triage

Sharing

General

Target

8cf26505203d553b12a389b745cc56b1_JaffaCakes118
Size

115KB
MD5

8cf26505203d553b12a389b745cc56b1
SHA1

86d99689b024fa5e00011488730322f8f33fab22
SHA256

5e38850c7d084959ee0d62fa802a9c3fd567d7c5229beb7dc6a7eb76e33bd34a
SHA512

48da22bd849cf34e3bb1b048bc7b096a781cb39b5fe0ed8234117f234e06d3d54215e3675591c2278ddf36380e494cffaa68edbf32b5d646241d1b7f82ad9b41
SSDEEP

1536:KUthJ4DCIiGIgT3DPdk9ypoSQnUJsBhNLw82aDBFtVltvHC8Yyx:KUtLFlgfPdk9ypHJqBhN0kDBFtpi8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8cf26505203d553b12a389b745cc56b1_JaffaCakes118

Files

8cf26505203d553b12a389b745cc56b1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

34e64abd5bf87bbfeaa991ef0aa19cb2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrcatA
GetStartupInfoA
CloseHandle
WriteFile
CreateFileA
lstrlenA
GetCurrentThread
GetTempPathA
lstrcpyA
GetTickCount
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
LoadLibraryA
CreateRemoteThread
ExitProcess
WinExec
GetCommandLineA

user32

CharPrevA
wsprintfA

shell32

ShellExecuteExA

ole32

CoInitialize

msvcrt

memcpy
??2@YAPAXI@Z
strrchr
strcpy
strncat
strstr
free
_except_handler3
_exit
_XcptFilter
_controlfp
exit
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__CxxFrameHandler
_acmdln
memset
strlen

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE